4

Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database.

GDPR states that it only concerns enterprises, and the possibility to be exempt when the company size is less than 250. However, it also describes this to be due to smaller companies posing a smaller risk.

To fall within the remit of the GDPR, the processing has to be part of an "enterprise". Article 4(18) of the Regulation defines this as any legal entity that's engaged in economic activity. You must be careful not to mistake business conducted from home for household activity.

Does this mean that students/individuals who process potentially huge amounts of PII are exempt from GDPR compliance? Or does GDPR cover this in another way?

6

Corrections to your statements or quotations

Your quotation "To fall within the remit of the GDPR, the processing has to be part of an "enterprise" (...)" is not from the GDPR, and is an erroneous statement.

Also, the threshold of 250 employees you refer to, is only relevant with regards to the record-keeping obligations of Article 30.

GDPR provisions relevant to your question

The GDPR applies to individuals or students in accordance with the material scope of the GDPR, which is treated in Article 2 (2) c) where GDPR states that "This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;"

The Recital 18 of the GDPR gives some insight as to what would be a purely personal or household activity as follows:

(18) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

Interpretation

To my knowledge, there are no specific guidelines regarding this matter to date from WP29. Those may be adopted in the future, or some requirements may already exist in local laws in one of the EU countries or from documentation available from local data protection authorities. If you are based in the EU, you could check this with your local data protection authority.

There is, however, case law from the European Court of Justice as pointed out by Free Radical, interpreting the scope of the "personal use exception" in Directive 95/46/EC (which provisions are similar to the GDPR in this matter).

If your hobby is not limited to your personal circle (yourself and the persons in your household), and thus if you plan to share the results of your data collection and processing with third parties (possibly teachers, other fellow students, or anybody else if you publish the results of your work) resulting from your "hobby" activity, you certainly would not fall in this exception to the scope. Case C-101/01 is an example of publication on the Internet made by an individual claiming to use its "freedom of expression to create internet pages in the course of a non-profit-making or leisure activity". The court clarified that:

exception must (...) be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people

Another, less optimistic interpretation from the examples given by the GDPR recitals, could derive from the spirit in which purely personal or household activity are to be understood. These examples actually refer to limited amounts of data and which are related to the individual itself (his own address book, his social networking activity, etc.), and creating limited risks relevant to the person herself and its contacts. In this view, there is a risk that a "hobby" in which you collect data about thousands of persons unrelated to you, could be considered as not being really purely personal.

Actually, an interpretation of case law C-212/13 from the European Court of Justice also mentioned by Free Radical could support this reasoning.

In this case, a video recording of people was stored from cameras installed by an individual on his family home for its own security purposes, but the cameras were also monitoring a public space. The court ruled that:

To the extent that video surveillance such as that at issue in the main proceedings covers, even partially, a public space and is accordingly directed outwards from the private setting of the person processing the data in that manner, it cannot be regarded as an activity which is a purely ‘personal or household’ activity (...)

Extending this reasoning to your question, a "hobby" consisting of collecting "huge list of names, emails, zipcodes" unrelated to you could be regarded as "directed outwards from the private setting (...)".

Conclusion

As a hobbyist, or a student, if you can work on fake computer generated data and achieve the same results in your personal learning purposes you should definitely consider doing so.

  • I've upvoted the answer. However, you write: "To my knowledge, there are no other specific guidelines regarding this matter to date from the EU or WP29." The "personal use exception" in the GDPR is identical to the same provision in Directive 95/46/EC. There is case law from the ECJ about the latter (e.g. C-101/01 and C-212/13). This case law support your conclusion. See "this related question for more. – Free Radical May 24 '18 at 10:17
  • @FreeRadical, thank you, you are right that the personal use exception is the same (however the recitals examples are new). I'll have a look at these cases and possibly update the answer. – Tardis May 24 '18 at 10:35
  • @FreeRadical, I have updated the answer with your inputs. About case law references, do you use a structured directory of case law for finding these types of cases, or do you find them with keywords and eur-lex.europa.eu/advanced-search-form.html – Tardis May 24 '18 at 11:38
  • "About case law references, do you use a structured directory of case law for finding these types of cases," I use an internal structured directory maintained by the institution where I work. It is not available to the public. – Free Radical May 24 '18 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.