GDPR - am I a data controller as an app owner if I do not have access to the data?

Question

1. Let's assume that I created a mobile app for iPhone that is tracking rides on a bike so that means the app is collecting GPS coordinates of the phone and later this mobile app shows some statistics about that. Also let's assume that the application keeps this gps data locally on the mobile phone only. So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct?

2. What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple in order to transform GPS coordinate to a name of a street and city so that app can display street/city name to the user (reverse geocoding service). But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me? Am I becoming data controller in such case if I have no idea when the app sends that GPS coordinate data to Apple and I do not know what coordinates it sends? I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request. I guess probably they do not save it but I can't be sure as I have no access to Apple service code. Or perhaps Apple is the data controller in such case or nobody is the data controller and GDPR does not apply at all?

Answer 1

Let's assume that I created a mobile app for iPhone that is tracking rides on a bike [...] So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct?

Yes, as far as I can see that is correct.

The GDPR defines a data controller as someone who "determines the purposes and means of the processing of personal data" - you just provide a tool, you don't control for what purposes your customers use their ride data. This is also discussed in this question: How does the GDPR apply to software developed by one company and used by another?

What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple

[...]

But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me?

Yes, and yes.

In that case, you are telling Apple to process data for you, so you would become the data controller (because you "determine[s] the purposes and means of the processing of personal data"), and Apple is a data processor for you.

That means also the usual mechanisms kick in - you need to inform your users about this processing, you need to make sure Apple plays by the rules, etc. etc.

I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request.

This is exactly the kind of situation the GDPR is meant to address. Under GDPR, saying "I do not know what X does with the data" is not an option. This is something many companies tried in the past, that is why GDPR explicitly assigns responsibility to the data controller (i.e., you).

As explained in a EU document, What is a data controller or a data processor?:

The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. [...]

So, no, you cannot just say "I do not know if Apple saves this request". Instead, you must make a contract with Apple which says whether (and how, and for how long...) they save the request, and you must inform your users about this in your privacy policy. And if Apple refuse to make such a contract with you, you must find a different company to work with.