3

I have a few doubts about GDPR law. If we are a mobile app, that allows user to store data inside our application like photos, videos, notes. etc., then do we have to get user consent or anything related to GDPR?

Example: a vault app.

Also, if the user is storing the data in our app, but the data is not encrypted, then do I need to encrypt data even if are aren't subject to GDPR?

The data is stored locally on the user's phone and it's not uploaded to server. It's like a private gallery application which is password-protected. The user can move photos.

Improve this question
12
  • 1
    To answer this, we need to know what processing you do. If you supply a vault app that stores data on the user's device and only the user has access to this data, you are not processing personal data, so the GDPR does not apply to the app.
    – Free Radical
    May 16, 2018 at 8:29
  • Yes we are not processing the data we only store the data for the user and apart from the user no one else has the access to it. Also, the data stored is not encrypted so does the GDPR applies as to we have to encrypt the data or anything like that ?
    – Frank
    May 16, 2018 at 9:24
  • 1
    @FreeRadical I think that point on processing is debatable - under GDPR, storing data IS processing it. see my answer
    – David
    May 24, 2018 at 12:50
  • 1
    @David. The answer to a "who"-question must be some human entity, not some computer application.The "app" can by its very nature not be the controller of this personal data. The apps legal owner can't be controller either, unless the apps legal owner controls the data (that follows from the GDPR defintion of "controller"). IBM is not the controller of personal data processed by IBM's customers.
    – Free Radical
    May 24, 2018 at 13:42
  • 1
    @David I can sort of see where you are coming from, but you seem to be making a distinction between data processed on a PC (e.g. by a spreadsheet or accounting program) and data processed on a mobile phone by an app. But in both cases it is the user's equipment running a program as instructed by the user. So I don't think your distinction is real. Perhaps this would be better asked as a Question on this site.
    – Paul Johnson
    Dec 21, 2018 at 12:07

2 Answers 2

Reset to default
2

Assuming the data is only stored on the users's device, (as mentioned in a comment), the GDPR does not apply to the developer of an application.

It could however apply to the user who uses the application. But the question seems to indicate it will be for private use only, the exception in Art. 2 (2)(c) GDPR would apply.

  1. This Regulation does not apply to the processing of personal data:

    (c) by a natural person in the course of a purely personal or household activity;

If the GDPR would apply, for example because it is used by a company storing photos of customers, it would be the responsibility of the user to comply with the GDPR. If the application is not GDPR-compliant, the user would have to stop using the application.

Improve this answer
1

if the user is storing the data in our app but the data is not encrypted then do I need to encrypt data even if we do not fall in GDPR?

This reply assumes that you are doing some of the processing and/or storage, as opposed to leaving it all on the user's device.

The GDPR does not directly mandate encryption. Article 32(2) says:

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

So you need to think about how sensitive the data is likely to be. Then design your data processing and management practices (e.g. which employees have access, what procedures must they follow) accordingly.

So the upshot of all this is, no you don't have to encrypt the user's files, but doing so might well be a good idea.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .