It is quite possible that Pushshift is not subject to the GDPR. But it's impossible to know for sure until a court rules on this specific case.
As Dale M's answer correctly points out, we have to consider Art 3(2) GDPR, since Pushshift is not EU-based:
This Regulation applies to the processing of personal data of data subjects who are in the Union
by a controller or processor not established in the Union,
where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
The critical question then is whether Pushshift triggers either the Art 3(2)(a) targeting criterion or the Art 3(2)(b) monitoring criterion. The EDPB has published their guidelines 03/2018 on the territorial scope of the GDPR to help us understand this.
Art 3(2)(a) targeting criterion
Whether a data controller is “offering” a service depends largely on the intention of the controller, and mere availability of their website is not sufficient. Recital 32 (quoted below) provides relevant factors to consider, and the EDPB document summarizes further factors from case law that would suggest a targeting intention.
[…] In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
The Recital 23 factors are:
- use of a language or currency generally used in one or more EU member states
- mentioning customers or users who are in the EU
Explicit non-factors are:
- availability of websites or contact details
- use of a language generally used in the controller's country
I cannot see that Pushshift would meet any of the factors that would cause GDPR to apply per Art 3(2)(a).
At most, it could be argued that Pushshift is so important that they should reasonably expect that their services will be used from the EU, so that they should reasonably expect themselves to be offering a service to people in the EU. But that's a rather convoluted argument.
Art 3(2)(b) monitoring criterion
This criterion is potentially more interesting since it doesn't rely on the intention of the data controller. But what is monitoring? Recital 24 of the GDPR explains:
In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.
The EDPB adds their interpretation that
While Recital 24 exclusively relates to the monitoring of a behaviour through the tracking of a person on the internet, the EDPB considers that tracking through other types of network or technology involving personal data
processing should also be taken into account
The EDPB gives clear-cut examples of monitoring:
- Behavioural advertisement
- Geo-localisation activities, in particular for marketing purposes
- Online tracking through the use of cookies or other tracking techniques such as fingerprinting
- Personalised diet and health analytics services online
- CCTV
- Market surveys and other behavioural studies based on individual profiles
- Monitoring or regular reporting on an individual’s health status
There is a potential argument that Pushshift's activities do imply such monitoring, since Pushshift's service makes it possible to search for one user's Reddit comments.
But I think that this argument is a stretch, since Pushshift itself does not make per-user inferences based on this data. Pushshift merely takes the Reddit data and indexes it. Yes, that is processing of personal data as defined by the GDPR, but it does not seem to be “monitoring” within the meaning of the GDPR. Thus, I think it is unlikely that Pushshift is subject to GDPR per Art 3(2)(b).
Conclusion
For GDPR to apply, one of the cases in Art 3 GDPR must be fulfilled. Art 3(1) does not apply due to the services location. Per the above analysis, Art 3(2)(a) is very unlikely to apply since there is no evidence of an intention to offer the service to people in the EU. The Art 3(2)(b) monitoring criterion is more interesting, but after looking at the relevant factors it too is unlikely to apply to Pushshift's actual service.
Thus, it is likely that Pushshift is indeed free from GDPR compliance concerns, which means not having to provide a privacy notice, not having to determine an appropriate legal basis, and not having to fulfill data subject requests such as when they try to invoke a right to be forgotten.
