2

I'm the owner of a website that maintains statistics about crew-members of an other site. The statistics about the crew-members are as follows:

  • Username (on that other website)
  • User ID (on that other website)
  • Registration date (on that other website)
  • Start date of crew-period (on that other website)
  • End date of crew-period (on that other website)

My website does not maintain any cookies, does not require a visitor to register an account, you can't even create an account, all data is public, and i don't show any ads on this site.

All the data that i collect, is collected manually, by hand, by searching through the history of threads on that website.

Is the data that i'm storing, against GDPR? Do i have to ask permission to every single user to store this data? And do i have to follow deletion-requests from users of that website that don't want their usernames to be shown on my website?

Improve this question
3

1 Answer 1

Reset to default
2

Art. 2(2)(c) GDPR does include a personal use exception:

  1. This Regulation does not apply to the processing of personal data:

    (c) by a natural person in the course of a purely personal or household activity;

As Free Radical noticed, this is clarified in Case-law (which refers to the identically worded exemption in Directive 95/46/EC). C-101/01 includes

  1. That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.

You also publish on the internet, making it accessible to an indefinite number of people, so the personal use exception probably does not apply to your website.

However Art. 85 GDPR includes a provision for exemptions or derogations for journalistic purposes. I think this would apply to you. However these exemptions are implemented by member states, so they could be different depending on where you live.

For example in the Netherlands, the Uitvoeringswet Algemene verordening gegevensbescherming excludes a lot of GDPR articles for journalistic purposes. Based on that, the answer to your questions would be:

  • Is the data that i'm storing, against GDPR?

    Art. 6 GDPR still applies, but you can base processing on freedom of information which is a legitimate interests as defined in Art. 6(1)(f):

    (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

  • Do I have to ask permission to every single user to store this data?

    No, as your processing is not based on consent, you don't have to ask anything.

  • And do I have to follow deletion-requests from users of that website that don't want their usernames to be shown on my website?

    The Right to erasure is included in Chapter 3 of the GDPR. When data is processed for journalistic purposes, chapter 3 does not apply in the Netherlands.

I assume, other countries have similar laws, but I did not verify this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .