0

I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct requests to it. Will the app developer be considered the data controller even though I do not have access to the user's data and the app does not make any requests to my server? All data is processed in memory but the credentials are stored into user's device local storage.

For example, Infinity For Reddit and Nitter.

Improve this question

1 Answer 1

Reset to default
0

Data controller is whoever determines the purposes and means of processing. But one app might be involved in lots of different processing activities, and they might have different controllers.

Clearly, the app developer cannot control for what purposes a third-party social media service might use the data. So the app developer wouldn't be controller for the activities on the social media backend. But the app developer is responsible for sending personal data to the third party service in the first place. And some processing activities might relate solely to the app, not to the social media service, for example analytics or crash reports.

Relevant case law here is the Fashion ID case, where the CJEU found that website operators who embedded a Facebook “Like” button on their pages are data controllers for the data collection via this embedded button, but not for what Facebook subsequentially does with the data.

If the app developer is the data controller for sending personal data to the social network, there would be the question of legal basis. However, this will typically be Art 6(1)(b) necessity for performing a contract with the data subject (providing the core services of the app), or maybe consent. This is not going to be a hurdle.

EPrivacy issues like access to on-device storage are squarely on the app developer – the remote service has no part in that.

Improve this answer
5
  • Thank you for the good answer! If the app does not send any data, but shows data from a third party website that requires login, the app developer is not the controller?
    – HenryFin123
    Commented Feb 1, 2023 at 20:08
  • 1
    @HenryFin123 The point of my answer is that we must ask: the data controller for what? The app developer is certainly data controller for some processing activities, but cannot be responsible for what a third party website does. Whether that website requires a log-in is probably not relevant here.
    – amon
    Commented Feb 1, 2023 at 21:39
  • The data controller defines the purposes of the processing of personal data. The third party website defines the purposes of the API, as a successful HTTP request requires certain parameters, such as cookies. In other words, the application developer cannot be considered as the data controller, because it cannot determine the purposes of the processing of personal data. However, the application developer controls the means by which the application works.
    – HenryFin123
    Commented Feb 2, 2023 at 9:54
  • For example, a user of my app can see personal messages or send a message to someone on Facebook, and can change certain settings on Facebook. All of these activities require user interaction. So I have no real control over what messages the user sends or what buttons the user wants to press. In practice, I exclusively define the means by writing an API wrapper that works like Facebook's mobile app. Am I considered a data controller in this case?
    – HenryFin123
    Commented Feb 2, 2023 at 9:54
  • @HenryFin123 I suspect that in your example, the app developer would be Controller for how personal data is communicated to/from the API, and how the personal data is processed in the app's user interface. The app developer can't be controller for how the data is process by the API. If both the app and API developers determine purposes and means for a processing activity, they might be joint controllers. Practically, this means that the app developer should provide their own privacy notice, and can't just link to the API's privacy notice.
    – amon
    Commented Feb 2, 2023 at 10:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .