No matter whether a website collects personal data or not, it seems that a privacy policy is required anyway, and such a policy should contain (citing article 13 of the GDPR, first paragraph):
(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;
What is "the identity" supposed to be, exactly? What forms of identity are allowed by the GDPR?
For example, I wonder if the domain name of a website can be considered an acceptable form of identification, allowing you to say that the data controller is "yourwebsite.com", for example. And the contact details could just be an email address on that domain, for example. Because if this was not possible, and if it was always necessary to specify the controller's name or a company name, then it would not be possible anymore to own an "anonymous website". Somebody might want to start an anonymous blog called "controversialstuff.com" and have a right to remain anonymous. How does the GDPR deals with this?
