1

This question seems related to this one. The new European "GDPR" ("General Data Protection Regulation") laws are confusing to me.

One can read everywhere that these will apply everywhere, not only inside the EU, although they are only there for protecting EU citizens.

So my questions are about the operation of a website without any commercial purpose, with no commercial processing of data, that should be accessible to everyone worldwide, including to EU citizens.

The purpose is strictly non-commercial to provide service of communication to a global religious community or anyone interested.

People can register accounts with user names tied to e-mail-address, and optionally more detailed information about themselves, and communicate with each other in a forum hosted on that website. Of course they do that on a voluntary basis, and they can delete their own information that they provided.

The website is currently hosted in the EU, but hosting could be transferred to another country. The domain owner is currently a EU citizen, but ownership could possibly be transferred to a non-EU-citizen.

I was wondering about these excerpts from Article 2 and Recital 18 quoted in that other question here:

Article 2 (2)c states that this regulation does not apply to the processing of personal data:

by a natural person in the course of a purely personal or household activity;

There also an unofficial description in Recital 18, that say:

(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

I am not able to parse this gibberish into human language with certainty of its meaning. Of course, all people handling any personal data on that website are natural persons. What would an unnatural person be? A cyborg? A Bladerunner replicant? A golem?

Activities there are neither household activities, nor private. Communication there is quite public.

Of course people could theoretically post any kind of data in the forum. In some cases some forum post might contain what is considered someone's private data, i.e. address of someone where some public event would take place. Or a quote from some person with their name or nickname etc., even quoted from other websites. We are opposed to restricting, policing and censoring the communication taking place. Could this be cause for trouble, given the non-commercial scope and purpose of the website?

And of course, there is some automation happening to make the website function. How else could a website operate? So for example I guess IP addresses have to be stored to make a login session persist while navigating the site.

I would like to know if there is anything to take care of here to not get into trouble with GDPR. And if it might help to transfer domain ownership and hosting out of the EU.

Thanks.

  • There are a lot of ways to do it. They involve not being in the EU and not serving anybody who is. GDPR does not apply everywhere - only within EU jurisdiction. It does not only protect EU citizens - it covers everybody in EU jurisdiction. – Nij Jul 22 '18 at 5:38
  • Ah I see, it covers everybody currently physically in the EU? I thought the opposite, that it should protect EU citizens, no matter where they currently are. – trollkotze Jul 22 '18 at 5:47
  • 4
    "Natural person" is used to mean "humans", because organizations, corporations, government, etc. are "legal persons" (you can sue Bank of America, or sign a contract with it), so stating "persons" would include those that. Note that "legal persons" do include humans. en.wikipedia.org/wiki/Legal_person. – SJuan76 Jul 22 '18 at 9:13
  • Also, consent is only one of the ways to be able to use a person's info; for example the use of the IPs to manage sessions would fall into the art 6. b) "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract" or 6.e) "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party [...]" – SJuan76 Jul 22 '18 at 9:21
  • The biggest obstacle could be if you want to collect data about the religious affiliation of the user; the GDPR would forbid you from forcing users to state it, and it even allows each EU state to decide if they ban altogether the possibility of the processing of that data, even if the user consents to it. – SJuan76 Jul 22 '18 at 9:24
1

Transferring ownership and hosting of the site out of the EU will - from a practical pov - provide protection against the GDPR - although you could still fall afoul of it (How are they going to enforce the breach of the law to entities which only operate outside the EU ?)

The activity you are involved in is not in the course of "a purely personal or household activity", so the exception carved out in Article 2(2)(c) would not apply.

Article 4(8) defines a controller as

"the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;"

Article 5(2) states

"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."

Thus yes, the GDPR would hold you liable - even though it is not a business or commercial enterprise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.