0

No matter whether a website collects personal data or not, it seems that a privacy policy is required anyway, and such a policy should contain (citing article 13 of the GDPR, first paragraph):

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

What is "the identity" supposed to be, exactly? What forms of identity are allowed by the GDPR?

For example, I wonder if the domain name of a website can be considered an acceptable form of identification, allowing you to say that the data controller is "yourwebsite.com", for example. And the contact details could just be an email address on that domain, for example. Because if this was not possible, and if it was always necessary to specify the controller's name or a company name, then it would not be possible anymore to own an "anonymous website". Somebody might want to start an anonymous blog called "controversialstuff.com" and have a right to remain anonymous. How does the GDPR deals with this?

2

The controller of the data is not (necessarily) the author of the website - only the controller must be revealed, the author can remain anonymous.

  • But the controller is often the website owner, and if the forum is meant to be "anonymous" the controller will not want to be explicitly associated with the website in any way, whoever they are. To me this means a website can't be completely anonymous. Unless it collects no personal data at all, maybe. But if IP addresses should be considered personal data, then there are virtually no websites on the internet that don't collect any personal data. – reed Oct 29 '18 at 16:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.