0

I am having an Android App which uses Advertising networks and other Analytics services.

Now under the GDPR the data controller which is me in my case is required to provide some rights to the user such as the user can view its data which is collected, user can download that data.

Now my question is whether am I required to provide those rights to the user for the data which is collected by the other services/Ad networks who are the data processor in my case.

The data is practically being collected by other services but legally I am the data controller and they are only the data processor hence I don't have access to their sever which stores data and will be difficult for me to provide those rights to he user.

Improve this question
4
  • First: The GDPR have no mention of a "data collector". Did you mean to say that you are a "data controller"? Second: What personal data are being prosessed by the data processors (IP-addresses, personal names, etc.)?
    – Free Radical
    May 18, 2018 at 3:44
  • @FreeRadical Sorry for my wrong wording. Yes I meant I am the data controller. The data collected are data such as Advertising Ids, Device Ids, Crash Logs, IP address etc. No name or email will be collected from the user.
    – Rajesh K
    May 18, 2018 at 15:26
  • @RajeshK: ID's of that sort are almost certainly Personal Information in the GDPR sense, and an IP address even more so.
    – MSalters
    May 18, 2018 at 22:24
  • @MSalters Thanks for your answer. But do I need to provide Data Subject rights to the user for the data collected by these service?
    – Rajesh K
    May 19, 2018 at 14:35

1 Answer 1

Reset to default
1

If you, as data controller, let your data processor process your data, but you have no control over the data, then you are breaking the law.

The fundamental idea in the GDPR is that the relationship between the controller and processor must be regulated by a contract known as the DPA (Data Processing Agreement), and that this contract must at least make sure that the controller can order the data processor to do whatever it is that must be done to preserve the data protection rights of user.

If you do not have a DPA with all your processors today, then you will be busy in the upcoming week.

It may a bit of a hassle to get a DPA set up. From experience I know that this is so if the other party is an USA company that is clueless about the GDPR. You can sometimes avoid the requirement for a DPA by curating the data before you hand them over to the third party. For instance, we strip the last octet of IP-addresses before letting Google Analytics have them. Then an IP-address is not personal data and a DPA with Google Analytics is no longer necessary.

You need to review the personal data you share with third parties, try to anonymize or pseudonymize those that can be curated, and make sure you have DPAs to cover the rest.

Improve this answer
6
  • One more question since you have mentioned about the Google Analytics in the answer do you provide your user option to download their personal data from Google Analytics? If yes then can you please guide me on how can I achieve the same.
    – Rajesh K
    May 19, 2018 at 14:34
  • @RajeshK. No, we do not provide our users with the option to download their personal data from Google Analytics. Since we curate the data we send Google Analytics to not contain personal data, Google Analytics do not process any personal data about our users. It is not possible for Google or ourself to extract any personal data about an individual user from the materials we submit Google analytics.This also means that the demographic data we get from Google analytics is less specific than it would have been if we had given Google Analytics personal data, But we can live with that.
    – Free Radical
    May 19, 2018 at 15:04
  • Really smart way of over coming that issue. But does you Android app use Fabric Crash reporter? Can you help with that also?
    – Rajesh K
    May 19, 2018 at 15:13
  • @RajeshK. No, we don't do that. (We don't even have any apps.)
    – Free Radical
    May 19, 2018 at 15:23
  • Any way thank you very much for all the help and guidance :)
    – Rajesh K
    May 19, 2018 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .