How can GDPR affect user generated content?

Question

I'm wondering where the lines of GDPR are in regard to user generated content and how it meets the Communications Decency Act.

Section 230 has been what ISPs and websites (Yelp as an example) use as a defense for processing and managing user generated data on individuals and businesses.

Effectively, this section immunizes both ISPs and Internet users from liability for torts committed by others using their website or online forum, even if the provider fails to take action after receiving actual notice of the harmful or offensive content

• Where do we stand in 2018/2019 with GDPR compliance vs user generated content?
• To what extent could an individual's private data be submitted by an anonymous user and then "processed" and made public by a website legally?
• What other implications does GDPR have on the Communications Decency Act?
• Are there differences in your answers when these questions are applied to the United States?

Answer 1

The GDPR can only be enforced in the European Economic Area. The Communications Decency Act only in the US. So basically they have no relation. However, the EU has the Electronic Commerce Directive 2000/31/EC which serves the same purpose as Section 230 of the CDA. The GDPR does not change that, it mentions this explicitly in Art. 2(4) GDPR:

4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.

This means that an ISP is not responsible for user generated content, but if they receive a notification of obvious unlawful content, they must remove it.

So it is not a problem for an ISP or other service provider to host private data submitted by an anonymous user. But they need to offer a notice and take down procedure. If the processing of private data was unlawful in respect to the GDPR, it must be removed.