2

I create the code that everybody can download for free and use on their website (MIT licensed).

In that code, I want to put the additional code sending requests to my server if the domain name is different than the one used by web browsers when developing locally (window.location.host)

It would not store any additional code (no cookies, no local storage) in page visitors' web browsers.

To download the package, you do not need to register to the service. There are many download methods, including

  • direct download from my website or Sourceforge
  • download from 6 public third-party code repositories (GitHub, GitLab, BitBucket, Beanstalk, Sourceforge, Launchpad)
  • download from package managers: Composer, NPM, NuGet and RubyGems (and Yarn and Bower in the result of NPM)

And it is very important to me that my package stays that widely available.

Question: How can I approach this to be GDPR compliant?

Improve this question
2
  • You do not say what you are going to do with the data you collect. If it is for "legitimate interests" (whatever that means) it could be legal. If not, you might need the users' consent. In any case, you might want to let people know that your FOSS application "calls home" and why, before somebody finds out and complains, no matter if it's legal or not.
    – reed
    Commented Jun 16, 2018 at 13:42
  • Personally, I am interested what will people do with the library. Business-wise the marketing part might reach out and suggest a different approach what in a long-term might land the domain owner (or maintainer) as a client.
    – wscourge
    Commented Jun 17, 2018 at 4:38

2 Answers 2

Reset to default
0

It already is compliant

GDPR stands for General Data Protection Regulation, and it related to how personal data is stored and processed. By tracking how many users are using your service or which countries most often use your service is not classed as personal data. For example, you may be aware that 23 users are actively using your service right now - that's not personal data. Even if you have a list of IPs that are currently connected & actively using your service, it's still okay. As long as you keep this data to yourself and only access it when you need to. Storing a list of IPs or domains that are currently using your service is not personal data.

Improve this answer
4
  • Wouldn't a personal domain be likely to identify a person, and fall under personal data?
    – jrtapsell
    Commented Jun 13, 2018 at 9:21
  • 1
    Not really. One could argue that the domain jimjones.com relates to a person called Jim Jones. You don't have any other information to correlate who that is (after all, there's more than one Jim Jones). You'd need something such as their address or phone number or SSN etc. to know WHICH Jim Jones it was. The only time I can see it ever being the case is whenever a celebrity uses your framework for their site, such as michaeljackson.com would be fairly obvious
    – Horkrine
    Commented Jun 13, 2018 at 9:39
  • IMO a domain is definitely personal data, as defined by the GDPR: "any information relating to an identified or identifiable natural person". The domain can often be linked to a person by looking at the website it refers to (contact info, the "about" page, etc.) or by querying some whois databases (if available and allowed), or by some other indirect methods.
    – reed
    Commented Jun 16, 2018 at 13:51
  • 1
    @reed: That's ICANN's problem at the moment. They are insisting on the whois data, but they have been informed that they are very much in violation.
    – MSalters
    Commented Jun 17, 2018 at 21:15
0

Domains themselves fall under GDPR as personal data.

Here is why. Regardless if you have the information or not, someone does know who that domain belongs to, IE a natural person. Thus the same logic which makes IP addresses personal data applies.

For that downvote: article 4.1:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Keyword there “online identifier”. So even a username falls under personal data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .