How does GDPR affect a personal web application that uses third parties to authenticate?

Question

I created a publicly accessible web application that allows me to remotely control the heating system in my home.

The only data the app itself collects is logs of user activity (e.g.: logging when I turn on the heating) which I don't believe constitutes personal information.

However, so as to limit access only to authorized users, I implemented third party authentication using Google. One can only try and log in with a Google account and it will fail if you are not registered, but one can also sign up for an account. When this happens, the app sends me an email with the email address and the name of the person that wishes to register. This information is given to me by Google. Based on this information I then decide if that user can create his account. The name and the email address are stored to remember if the user was allowed to register or not.

The GDPR regulation states that:

This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

I should be ok, since control of my home's heating is pretty much a household activity. Would this still be the case given that I use Google for authentication?

Answer 1

As I read your description, it is not you who stores the data of that person account but Google; Google only shows you the data to allow you to grant or deny access, and remembers that decission.

From here, there are two parts:

• Google is the controller. It holds the actual data and has only showed it to you so you can grant or refuse access to your system.

• You are a processor of data.

Your part as a processor is exempt from GDPR because it is part of the household activities exception. Of course, that would be void if you tried to use the data for any other purpose (e.g. sending spam to the users trying to sell your application). Additionally, probably Google Terms of Service adds some clauses stating the same.

Even if you weren't exempted, one of the motives that allow for processing personal data is having a legitimate motive. Obviously controlling who can access your home heating system is a legitimate motive. Remembering those who have asked for access but have been denied also has the legitimate justification of remembering the decision and avoiding that people repeating their requests.

Yes the exception applies. Even if it didn't, it is Google the one that controls the data and has to care, you are just an operator