3

I am building an app where I have some concerns about GDPR and user data.

First of all this is a personal app, no company behind.

What the app does:

  • Allows a user to authenticate via e.g. Facebook and stores some basic data (optional)
  • Allows a user to upload a GPX file (a route or some other activity)
  • Stores the above file to Google's database
  • Allows the user to analyze that file.

I do know what needs to be done if the app was not a personal app, but I am not sure if I really need to do all the actions (consent, deletion, takeout data) in my case where this is just a personal website/app and nothing more.

Improve this question
4
  • Who will be the users of the web app? Will it just be your family or friends, or will anybody be able use your web app? (I am asking to determine if Art 2(2)(c) applies). Do you perform any kind of moderation? (I am asking to determine if Art. 2(4) applies). And why do you think you would need (explicit) consent if it was not a personal app? When you talk about Google's database, do you mean the google cloud?
    – wimh
    Dec 31, 2018 at 18:18
  • Hey @wimh thanks a lot for asking and taking the time. - Everyone would be able to find and use my app. It's opesource, in theory he could even build it him self. - If moderation is something such deleting data, clearing the db etc perhaps yes if needed so or asked I suppose. But not by my own will or to filter out data. - I am not sure if I need a concent, from what I read it's what other corp websites do eg to track. - Yes google cloud, google firebase platform specifically but it's stored at the link you provided. (cloud storage)
    – Jimmy Kane
    Dec 31, 2018 at 18:30
  • Thank you for your reply. With the first question I mean in particular if you offer it as a service to other users.
    – wimh
    Dec 31, 2018 at 18:38
  • @wimh yes. Eventually, I would like people to use it. So for now perhaps unlisted but definitely when it's ok I would love to share the app.
    – Jimmy Kane
    Dec 31, 2018 at 18:39

1 Answer 1

Reset to default
3

An app(lication program) is software run on the end-users machine. That does not fall under the GDPR.

Any processing (including storage) you do on user data has to be compliant with the GDPR.

  • Allows a user to authenticate via e.g. Facebook and stores some basic data (optional)

Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data.

Providing this "basic data" as a JSON or CSV file should meet data portability requirements.

  • Allows a user to upload a GPX file (a route or some other activity)
  • Stores the above file to Google's database
  • Allows the user to analyze that file.

Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to do this under the GDPR. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission.

Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent).

Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data.

Finally, make sure there is a "Close my account and delete all my data" option.

Improve this answer
4
  • Loud and clear sir. Happy new year and thanks a ton for this.
    – Jimmy Kane
    Jan 1, 2019 at 10:56
  • Last time I checked, Google is also a multinational company
    – Dale M ♦
    Jan 1, 2019 at 22:43
  • 1
    @DaleM Which is why I also suggested providing a username/password option.
    – Paul Johnson
    Jan 2, 2019 at 9:34
  • regarding the company part , my intent is to implement even sms login so no worries
    – Jimmy Kane
    Jan 4, 2019 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .