0

Why don't most privacy policies include links to the privacy policy of the company that is hosting the website? One would think that that given all the data that the host collects, that would be required.

Improve this question
2
  • Free Radical has since deleted a comment where he actually claimed to have called the hosting company mentioned below. Maybe it was too much too believe? So that is something one should consider when evaluating the credibility of his other claims below.
    – user300258
    May 14, 2018 at 12:33
  • I called them (Why should I invent that story? It is very easy to call the sales department of a web hosting company and ask them if they offer a DPA.) I deleted the comment because: 1) my description of WHUK's fine service was more negative than necessary, and 2) you insisted that "every single internet host is exactly just like WHUK". That means that my negative comments about the service offered by this particular hosting company was no longer relevant to the discussion at hand.
    – Free Radical
    May 14, 2018 at 12:48

1 Answer 1

Reset to default
1

This terminology used in this answer is valid for EU (the controller-processor relationship referred to was introduced in 1995, and is perpetuated in the GDPR). It may that non-EU jurisdictions uses different terminology.

The relationship between the owner of the website (controller) and the hosting company (processor) is contractual (usually in the form of a signed Data Processing Addendum - DPA). The terms of the conditions of the DPA are usually very different from the public Privacy Policy of the hosting company (which is about how it processes personal data about its customers, not how it processes personal data under the supervision of one specific customer).

Since the processor is contractually bound to abide by the DPA (not its public privacy policy) when acting as a processor, its public privacy policy is irrelevant to the audience the controller's public privacy is intended for.

Any serious hosting company that wants to do business in Europe after May 25 2018 will offer a DPA. Here is a link to the page for requesting one from Amazon AWS.

Improve this answer
7
  • Sure. OK, fine. But then the question just shifts to: Why don't most privacy policies include links to the DPA of the host company? Add to that the fact that in 99.99% of cases, the host company drafts the DPA.
    – user300258
    May 14, 2018 at 7:14
  • It a very rare occurance that the DPA is publicly available. I work in a hosting company, and yes, I am usually the one creating the DPA for the client. I would not want to make any of the DPAs I've created public (for a number of reasons, including security). All the public need to know (what data is being processed, for what purpose, and the legal grounds for processing) should be in the privacy policy of the controller.
    – Free Radical
    May 14, 2018 at 7:31
  • Hmm...Usually, when a company chooses a host, they go to the hosts website, click on some boxes, and give a credit card. So, whatever contracting is done has to be done then. In other words, the DPA would have to be public. For example, let's suppose Free Radical decides to set up a website tonight and he decides to use a European hosting company. For example: webhosting.uk.com He sits down tonight to draft the privacy policy for his relationship as "controller" with his users. But his host is collecting all kinds of data. Where does he get the DPA from webhosting.uk.com?
    – user300258
    May 14, 2018 at 7:54
  • Right. But my point is that every single internet host is exactly just like WHUK. I picked them randomly. Can you show me any host that has a publicly available DPA? Or is it your position that the overwhelming vast majority of hosts are unusable? But somehow the host that you work for does it correctly? Everybody else has been wrong? Please address the matter of how people can sign up for hosting without the DPAs being public? How can a host have thousands of customers without their DPAs being public? You're occupying a tiny location in logical space.
    – user300258
    May 14, 2018 at 11:20
  • "Can you show me any host that has a publicly available DPA?" No. And that is why I wrote this: "It a very rare occurrence that the DPA is publicly available." When it is not public, one can not link to it. That does not mean that a DPA cannot be negotiated for clients that need one. Btw. this has no longer anything to do with the question you asked (which has been answered). I see no point in continuing this exchange.
    – Free Radical
    May 14, 2018 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .