I am asking this question based upon the specific case of open source software sites, but the concept should probably apply equally to other websites that serve as a "platform" for their users to publish and collaborate.

I have a number of open source software projects that I develop during my spare time on various large open source software (OSS) websites (think Github, SourceForge, ...).1

I sent some GDPR-related inquiries to them to find out about how I can make my project sites GDPR-ready. Something that appeared to be more or less a consensus was that for the representation of my projects that are displayed in the OSS websites' default layout, they are the "controller" and I am a "processor".

Now, if I am a processor, wouldn't those controllers have to make me sign a DPA? I am wondering especially for the case of forwarding notifications about activity related to my projects to my e-mail. Such notifications are likely to contain some kind of personal information (at least the name of a fellow user who did something related to my project).

Bonus question: Does that also mean I am not allowed to set up the e-mail forwarding to any of my existing (mostly Germany-based, if that makes any difference) e-mail accounts, but need to sign up a for a "business-level" (or whatever it's called) e-mail account somewhere so I can have a DPA with the e-mail provider?2

1: These websites are based in the U.S. This is not generally my preference, but there simply seems to be no comparable website for such services anywhere else.

2: It's indeed still unclear whether an e-mail provider counts as a processor for which a DPA is needed. If it turns out it does not, the second part of the question is a non-issue.

  • Do you just develop software (ie. making available for others to download), or do you also host your own server where the software runs? – wimh Jun 23 '18 at 21:18
  • @wimh: Just the former. – O. R. Mapper Jun 23 '18 at 21:23
  • I think you are not the processer, but you might be joint controllers based on C-210/16. I have to reread that judgement, maybe I'll answer tomorrow. – wimh Jun 23 '18 at 22:41
  • @wimh: That is an interesting interpretation. However, wouldn't that imply that I have to link to a privacy policy of my own, even on pages whose content and layout I cannot influence? – O. R. Mapper Jun 28 '18 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.