Do web applications as hobby projects need to comply with the GDPR?

Question

I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation.

2) This Regulation does not apply to the processing of personal data: in the course of an activity which falls outside the scope of Union law; by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; by a natural person in the course of a purely personal or household activity; by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

From Article 2 of the GDPR (https://gdpr-info.eu)

• Does this mean I don't need to comply with the GDPR if I'm not an organisation?
  
• If I was an organisation, how simple it would be to comply with this law, to avoid civil liabilities?

Answer 1

Recital 18 gives some more details on that:

This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities.

So what matters is whether your activity is professional/commercial or not (you do not necessarily need to be an organisation to do business). If your web applications do not sell goods/services or otherwise create business-customer relationships — feel free to ignore GDPR.

Answer 2

As always, it depends.

However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR.

Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet.

However, when considering this, one should take the following two facts into consideration.

1. The "personal use exeption" in the GDPR is not new.

The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.)

2. Case-law under the previous regulation restricts the scope of the exception

The ECJ has ruled on the scope of the personal use exception in two cases:

• C-101/01
• C-212/13

In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply.

Discussion

Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR.

However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR.

Conclusion

IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.