7

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:

by a natural person in the course of a purely personal or household activity;

This sentence is known as the personal use exemption. When this was included in the GDPR, the drafters decided to keep the personal use exemption unchanged from the article 3(2) of Directive 95/46. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.)

There also an unofficial description in Recital 18, that say:

(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

This says that you're not exempt for processing that has connection to a professional or commercial activity. But it is very ague on what makes you exempt. Does "social networking" include maintaining your own blog, or are they only referring to your activities on Facebook and similar "social" media where you obviously are not the controller (the controller is who owns and runs the platform)?

A key question, partly arising from a lengthy discussion thread under the answer by @Greendrake in this related question, is whether this means that a publicly accessible, personal blog is excluded from the scope of the GDPR?

To answer this question, one need to consider that the GDPR Article 4 definition 1 says that:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

We know from EU case law that this also includes IP-addresses, since such online identifiers indirectly makes people who is visiting such a publicly available personal blog identifiable.

Also, note that the scope of the GDPR is processing of personal data. This is defined in GDPR Article 4 defintion 2:

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Some critics of the GDPR have objected that such a definition of ‘processing’ is over-reaching. However, it being over-reaching does not mean that we should ignore it.

In conclusion, I would like to link to two seminal cases heard by the ECJ:

Central to both cases was the question of whether the processing activities of an individual was covered by personal use exemption under article 3(2) of Directive 95/46. In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals.

The questions is: Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR to avoid having to comply with the regulation? If "yes": What need to be considered by its owner?

  • Are you essentially asking whether a blog can be regarded "a purely personal or household activity"? Well, that depends on what the blog does, and Recital 18 you recited explains it pretty clearly. If you sell goods or services through your blog then it is not excluded. If you do not, then it is. IP addresses etc. are for your hosting providers to worry about ("processors which provide the means"). – Greendrake May 17 '18 at 13:08
  • 1
    @Greendrake. Yup. That is what I am asking. And for the record. I do not agree with your interpretation of Recital 18. As for IP-addresses, it follows from this question that this personal blogger did monitor IP-addresses and wanted to know about whether he had comply with the GDPR, or was exempt - where the "household activity" exemption was suggested by somebody as grounds for him being exempt. – Free Radical May 17 '18 at 13:14
  • @Greendrake: "If you sell goods or services through your blog then it is not excluded. If you do not, then it is." - are you sure it's that easy? At no point does Recital 18 say that if you don't sell anything, you're exempt. It just says that if you do, you are not. For instance, I work as a software developer. If I were to blog about tricks and caveats in my favourite programming language without selling anything, that would still quite obviously have a "connection to a professional activity". Moreover, at least some EU member states seem to take it for granted that whatever is directed ... – O. R. Mapper May 19 '18 at 15:48
  • 1
    @Greendrake , IP addresses are absolutely not simply "for your ISP to worry about." – A.fm. May 21 '18 at 0:07
  • 1
    @Greendrake: I think the line between purely personal and household is much tighter than you think. E.g. German courts have decided that already small ad banners on a blog imply that the web page in question is commercial. – cbeleites May 22 '18 at 1:15
6

I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to:

  1. personal information published on the blog pages
  2. personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR)
  3. and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains)

Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here.

About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity".

C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog.

Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity.

Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR).

There may be other approaches apart from these 3, but that's a start for your considerations.

  • 2
    Thank you for enumerating these considerations. I refer to all three of them, and a better question would be: Is it possible for a personal blog to make use of the personal use exception, and if "yes", what considerations must be taken. – Free Radical May 24 '18 at 13:18
  • 1
    @FreeRadical, then you have your answer as considered in case number 2 ;-) – Tardis May 24 '18 at 15:18
0

No, but ...

A personal blog only has the personal details of one person - the author. I think consent can be assumed.

  • 5
    I don't think we can rule out that someone with a personal blog can blog about friends, neighbors and even personal enemies - so I disagree about that we always can assume consent. Further, I think we need to consider more than the published content in the blog when we're dealing with the GDPR. What about IP-addresses of visitors? Those are by default logged on any sensible blogging platform without consent. I've updated the question with some explicit definitions of "personal data" and "processing" - copypasted from the GDPR. Perhaps you could expand the answer a bit? – Free Radical May 17 '18 at 11:20
  • A blog that mentions someone's friends or neighbors does not mean personal data is stored about said friends or neighbors. As you note in the last part of your question, @FreeRadical, the GDPR is about the processing of data. – A.fm. May 17 '18 at 12:49
  • 3
    @A.fm. Do you know about a blogging system that allow the blogger to mention somebody's name without storing the name on the computer system? – Free Radical May 17 '18 at 13:06
  • 1
    @A.fm.: Article 4 of GDPR says: "‘processing’ means any operation or set of operations which is performed on personal data (...) such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;" (emphasis by myself). At the very least the forms of processing I emphasized are obviously fulfilled by a blog that mentions someone's name. – O. R. Mapper May 19 '18 at 15:57
  • 2
    @A.fm.: "as the GDPR doesn't apply to OP's blog anyway" - now where do you take that from? – O. R. Mapper May 21 '18 at 20:26
-1

Importantly, you should note that

The most important change is the fact that IP addresses and location data are also considered as personal data. IP addresses fall into personal data in the hands of a website operator if:

There is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and

The website operator has a “legal means” of obtaining access to the information held by the ISP in order to identify the individual.

  • 3
    Where is the answer to what the OP asks? Are personal blogs excluded or not? – Greendrake May 17 '18 at 12:59
  • If you read the quoted text, you’ll find the info. – A.fm. May 19 '18 at 0:53
  • 3
    @A.fm. "If you read the quoted text, you’ll find the info." Well, I've read it, and I don't see any info that answers my question. The fact that IP addresses are personal data are even spelled out in the question. Could you edit your answer and make it clear why you think this is a valid answer? – Free Radical May 21 '18 at 5:21
  • @FreeRadical, it's a moot point, anyway, as the GDPR would likely not apply to your personal blog. – A.fm. May 21 '18 at 11:16
  • 3
    @A.fm. "the GDPR would likely not apply to your personal blog". That's the question! Do the GDPR apply to my personal blog? (Yes or no, and hopefully the answer will say why the answer is "Yes" or "No".) – Free Radical May 21 '18 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.