3

I have a small static personal website, where I publish some technical articles and my personal CV. Do I need to include a privacy-policy if:

  • There are no (third- or first party) tracking services used
  • There are no IP logs kept
  • There are no comment fields or other features where users can enter information to be saved
  • I do not publish information about specific persons in the articles

To provide an idealized model, assume that the server is configured to forget ALL state after serving a HTTP request for the website. Nothing about the request is saved. Not even information like traffic statistics that would confirm a request happened at all.

An additional concern would be that website is hosted on a root-server with a German provider (Netcup). Do I need to inform people that this provider could theoretically collect data (still nothing more than IP addresses with timestamps and encrypted TLS traffic)?

Improve this question
1
  • I am also building a website something similar and I had the same doubt and got it clarified now. Do you have some sort of template that you have used or if you used any of the online tools to generate the complete GDPR policy? Please provide some suggestions on the template or blueprint which is needed for these types of websites.
    – BATMAN_2008
    Sep 5, 2022 at 11:42

1 Answer 1

Reset to default
4

Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR.

Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains.

Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes.

So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht.

As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings.

In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .