Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR?

Question

The GDPR Article 2 defines the material scope the regulation. Article 2 (2)c states that this regulation does not apply to the processing of personal data:

by a natural person in the course of a purely personal or household activity;

This sentence is known as the personal use exemption. When this was included in the GDPR, the drafters decided to keep the personal use exemption unchanged from the article 3(2) of Directive 95/46. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.)

There also an unofficial description in Recital 18, that say:

(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

This says that you're not exempt for processing that has connection to a professional or commercial activity. But it is very ague on what makes you exempt. Does "social networking" include maintaining your own blog, or are they only referring to your activities on Facebook and similar "social" media where you obviously are not the controller (the controller is who owns and runs the platform)?

A key question, partly arising from a lengthy discussion thread under the answer by @Greendrake in this related question, is whether this means that a publicly accessible, personal blog is excluded from the scope of the GDPR?

To answer this question, one need to consider that the GDPR Article 4 definition 1 says that:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

We know from EU case law that this also includes IP-addresses, since such online identifiers indirectly makes people who is visiting such a publicly available personal blog identifiable.

Also, note that the scope of the GDPR is processing of personal data. This is defined in GDPR Article 4 defintion 2:

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Some critics of the GDPR have objected that such a definition of ‘processing’ is over-reaching. However, it being over-reaching does not mean that we should ignore it.

In conclusion, I would like to link to two seminal cases heard by the ECJ:

• C-101/01
• C-212/13

Central to both cases was the question of whether the processing activities of an individual was covered by personal use exemption under article 3(2) of Directive 95/46. In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals.

The questions is: Is it possible for a publicly accessible, personal blog to make use of the personal use exception of the GDPR to avoid having to comply with the regulation? If "yes": What need to be considered by its owner?

Answer 1

I think that one cannot answer a question such as "Will the personal use exception in the GDPR apply to personal blogs?", because it is unclear if you refer to:

1. personal information published on the blog pages
2. personal information collected from the Website, by way of forms, cookies, server logs, strictly collected and processed for the purpose of operating the Website for your own personal purposes as a blogger (by yourself of through a subcontractor in the sense of GDPR)
3. and not personal information collected from the Website's operation, transferred or provided to third parties for their own purposes (this would include cookies used to identify and track users across multiple domains)

Regarding 1., a personal blog wanting to benefit from the exemption should not publish third party's personal information without their consent or another legal basis, and C-101/01 certainly applies here.

About 2., if the information is strictly collected and used for the own personal purpose of the operation of the blog, I would tend to agree that it should benefit from the exemption. I feel that C-212/13 would not necessarily be an indication that because the blog is publicly accessible it is then "directed outwards from the private setting" in the sense of this ruling, and should not be considered as "purely ‘personal or household’ activity".

C-212/13 case was relating to a camera installed by an individual on his family home for its own security purposes which was also monitoring a public space. The persons filmed on this public space had absolutely no direct connexion with the person collecting their images. In case of a blog, the visitors of the blog interact with the blog for fulfilling the own personal purpose of the operation of the blog of the publisher of the blog.

Another argument is given by the Recital 18 which you quote: a personal blog can be viewed as a type of social networking or related online activity.

Finally, about 3., there is no doubt for me that, in this case, the publisher of the blog is engaged in an activity which is not personal, since it willingly provides personal information to third parties which they use for their own purposes (and not as subcontractors in the sense of GDPR).

There may be other approaches apart from these 3, but that's a start for your considerations.

Answer 2

No, but ...

A personal blog only has the personal details of one person - the author. I think consent can be assumed.

Answer 3

It depends. I wrote a blog post with many more details about this: GDPR for personal websites. Have a look there. I'll summarize here.

My interpretation is that it depends on who controls the blog and what personal data you process. If you are the controller of the entire blog, then you most likely process some personal data of public visitors and that does not seem fall under the "purely personal" exception when looking at precedents.

On the other hand, if you post something on Facebook about yourself and your family, that would be included in the exception for "purely personal activities". In this case, Facebook is the controller for any other personal data processing. If, however, you collect personal data by spying on your neighbours and post that on Facebook, your processing of this personal data will again not fall under the exception (since it's directed outwards, away from your personal life).

I think there is a situation where a publicly accessible personal blog can be covered by the "purely personal" exception. It's when you use a blog service that is fully controlled by a company (similar to posting on Facebook or Twitter) and where you only write the blog posts by using data purely related to your own life.

Somewhere between these extremes, there's a line where you become the controller for the processing of all personal data (such as IP addresses in access logs or cookies) on a personal blog and once you cross that line, my interpretation is that the exception for "purely personal activities" no longer applies.

Of course, if the personal blog manages to avoid processing any personal data, then the exception won't matter in the first place, so it's fair to assume that it's not the case here.

Answer 4

Importantly, you should note that

The most important change is the fact that IP addresses and location data are also considered as personal data. IP addresses fall into personal data in the hands of a website operator if:

There is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and

The website operator has a “legal means” of obtaining access to the information held by the ISP in order to identify the individual.