3

https://www.truevault.com/blog/do-i-need-to-be-gdpr-compliant.html

GDPR was created by the European Union to protect its citizens, and so it only affects organizations with some kind of relationship with the EU or its people. That said, it does not only apply to companies based in an EU country. According to Article 3, you will be affected if you are a data controller or data processor and any of the following apply:

  • you are established in the EU (or somewhere else subject to EU law), or
  • you offer goods or services to individuals in the EU, or
  • you monitor the behavior of individuals in the EU.

What does the last point here, "monitor behaviour of individuals in the EU", mean?

Let's say, for basic functionality of a website, some rudimentary use of cookies is required to make the UI function as expected. Would that amount to "monitoring behaviour", because some UI state information might be saved in cookies?

Improve this question

2 Answers 2

Reset to default
1

The text from Article 3 of the regulation is:

  1. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Article 3 is about the scope of the regulation. This particular question is clarified by Recital 24 (emphasis added).

1 The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. 2 In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

The point of all this is that if you are collecting data about someone who is currently in the EU then the GDPR applies to you, regardless of where you are. The "currently in the EU" bit is significant: the GDPR doesn't apply if you collect data about the activities of an EU citizen who happens to be currently in the US, but it does apply to a US citizen who is visiting the EU. The term "behaviour" is used to distinguish data about what someone is currently doing from static data such as date and place of birth (which is presumably much more tied to nationality than current location).

Based on this recital, it seems unlikely that some functional cookies constitute "monitoring". If the cookies are only used for short-term functionality then you can make sure of this by giving the cookies a short expiry date or making them session cookies.

Improve this answer
0

Recital 30 mentions the use of Cookies, stating:

(30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.

This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

So the answer is "it depends what the cookies do". If the cookies are used to track the user or there movement through the site then it would most likely fall foul of the law (if not disclosed). If its very generic and not used for tracking purposes you are probably OK.

It may be noteworthy that - as I understand it - Recitals are used for interpretation and guidance, but are not the actual regulation. According to this link recital 30 is relevant to Article 4 (Definitions) which does not actually mention cookies.

Improve this answer
3
  • The link you posted is from a private organisation unrelated to the EU. They don't decide which recital is relevant for which article. But I think what is meant here is for example the way facebook tracks users across websites (all websites which contain a like button). I hardly think a cookie which is just used on a single website can be considered monitoring, unless your website is as large as amazon... (and monitoring is also possible without a cookie, for example using the ip address or fingerprinting).
    – wimh
    Aug 3, 2018 at 22:43
  • @wlmh I don't think that the bar is that high - ie I don't think there is any requirement that the cookies are cross-site - by my reading even something as simple as a persisting cookie that creates a trail of how a user interacts with even just the site they are on is captured by this - although this would still not seem to be an issue for the OP . In my eyes recital 29 would tend to support my reading. (I agree that the site I listed is not "the official" text, however the recital itself is part of the official GDPR)
    – davidgo
    Aug 3, 2018 at 23:29
  • "a persisting cookie that creates a trail of how a user interacts with even just the site they are on is captured by this": doesn't the GDPR apply only to the extent that tracking data from the cookie leaves the user's device and to the extent that it can be used to identify the user? If a news site stores on its server a list of articles sent to a device, that doesn't seem like it could identify the user. Or if it stores on the device a set of data that unambiguously can be used to identify the user, but processes the data only on the device, why would GDPR apply?
    – phoog
    Nov 20, 2018 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .