This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016.

According to Article 27 (Representatives of Controllers or Processors not established in the union), section 3 states that;

The representatives shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behavior is monitored, are.

In layman's terms, this means that any data processor (so someone who will handle any PII data of EU Citizens), must have a representative physically located within the EU. This means that as a Data Controller, Ebay must ensure that any third party companies they pass information to MUST have a representative within the EU, or they are failing their compliance with GDPR.

My Query stems from the Ebay user privacy notice, which seems to attempt to subvert this ruling within its terms and conditions by attempting to convert the Data Subject into a Data Controller at the point of purchase, renegotiating the conditions of any contract and removing Ebay from the position of Data Controller, despite their clear function as such.

When you transact with another user, we enable you to obtain or we may provide you with the personal information of the other user (such as their name, account ID, email address, contact details, delivery and billing addresses) to complete the transaction. Independent from us, you are the controller of such data and we encourage you to inform the other user about your privacy practices and respect their privacy. In all cases, you must comply with the applicable privacy laws, and must give the other user a chance to remove them from your database and them a chance to review what information you have collected about them.

If Ebay is functioning as the Data Controller (after all, they pass your information along to third parties and shipping companies, outside of the EU), how can they legally transfer the role of Data Controller to a Data Subject? It seems as though trying to pass responsibility onto the Buyer is an attempt to transfer liability that the third parties are themselves compliant...?

migrated from security.stackexchange.com Dec 4 '18 at 13:29

This question came from our site for information security professionals.

  • Aren't they just pointing out that if a user receives PII, they are a data-controller for that data. It doesn't appear (from the snippets you quoted; I've not read the whole thing) that they are disclaiming being a data-controller for all the user data they hold. A given piece of PII may exist in multiple systems (user's + eBay's), and be "controlled" by multiple people (user + eBay). – TripeHound Dec 4 '18 at 14:27
  • @TripeHound, but even that scenario would make you and eBay Joint Controllers; yet it is still eBay passing your data to a third country processor, who may not be compliant... but asking you, as a Subject, to perform the due diligence on that controller. – John Smith Optional Dec 4 '18 at 14:41
  • I see it as talking about another Subject's data ("personal information of the other user") that is being passed to "you" and which, therefore, you are now a controller of (if I had to guess, this section might be primarily aimed at sellers, who might well maintain a database of their customers, and -- what eBay is saying -- must do so in a compliant way). Your details would also be passed to that "other user", who would also be under a similar obligation to handle them compliantly. Meanwhile, both users' details (plus others) will be held by (and, hopefully, handled compliantly by) eBay. – TripeHound Dec 4 '18 at 14:51
  • gotcha! Flip it though... are eBay likely to give my details to a user in a country stated as non adequate, which (as a processor), means passing to a non-compliant entity? – John Smith Optional Dec 4 '18 at 15:05
  • Ebay is an intermediary, an for it's service it can send data to any country based on art. 49(1)(b). Ebay is no party in the contract between seller and buyer. So ebay cannot be the controller of that part. (correct link to current ebay privacy policy.) – wimh Dec 4 '18 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.