Allow people to communicate on an international religious non-commercial website without getting into trouble with GDPR

Question

This question seems related to this one. The new European "GDPR" ("General Data Protection Regulation") laws are confusing to me.

One can read everywhere that these will apply everywhere, not only inside the EU, although they are only there for protecting EU citizens.

So my questions are about the operation of a website without any commercial purpose, with no commercial processing of data, that should be accessible to everyone worldwide, including to EU citizens.

The purpose is strictly non-commercial to provide service of communication to a global religious community or anyone interested.

People can register accounts with user names tied to e-mail-address, and optionally more detailed information about themselves, and communicate with each other in a forum hosted on that website. Of course they do that on a voluntary basis, and they can delete their own information that they provided.

The website is currently hosted in the EU, but hosting could be transferred to another country. The domain owner is currently a EU citizen, but ownership could possibly be transferred to a non-EU-citizen.

I was wondering about these excerpts from Article 2 and Recital 18 quoted in that other question here:

Article 2 (2)c states that this regulation does not apply to the processing of personal data:

by a natural person in the course of a purely personal or household activity;

There also an unofficial description in Recital 18, that say:

(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

I am not able to parse this gibberish into human language with certainty of its meaning. Of course, all people handling any personal data on that website are natural persons. What would an unnatural person be? A cyborg? A Bladerunner replicant? A golem?

Activities there are neither household activities, nor private. Communication there is quite public.

Of course people could theoretically post any kind of data in the forum. In some cases some forum post might contain what is considered someone's private data, i.e. address of someone where some public event would take place. Or a quote from some person with their name or nickname etc., even quoted from other websites. We are opposed to restricting, policing and censoring the communication taking place. Could this be cause for trouble, given the non-commercial scope and purpose of the website?

And of course, there is some automation happening to make the website function. How else could a website operate? So for example I guess IP addresses have to be stored to make a login session persist while navigating the site.

I would like to know if there is anything to take care of here to not get into trouble with GDPR. And if it might help to transfer domain ownership and hosting out of the EU.

Thanks.

Answer 1

Transferring ownership and hosting of the site out of the EU will - from a practical pov - provide protection against the GDPR - although you could still fall afoul of it (How are they going to enforce the breach of the law to entities which only operate outside the EU ?)

The activity you are involved in is not in the course of "a purely personal or household activity", so the exception carved out in Article 2(2)(c) would not apply.

Article 4(8) defines a controller as

"the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;"

Article 5(2) states

"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."

Thus yes, the GDPR would hold you liable - even though it is not a business or commercial enterprise.