2

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have the right to data portability? There's no data stored for me to send them. If a visitor tried to exercise this right, what should I do as the owner of such website? Just tell them there's no data?

Improve this question

1 Answer 1

Reset to default
4

You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine.

It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.

Improve this answer
2
  • 1
    It's also a chicken-and-egg problem. Informed consent requires you to inform the user what he's consenting to. Which language are you using for that?!
    – MSalters
    Mar 28, 2019 at 14:46
  • 1
    @MSalters Good point. I haven't thought about that. As Amon said, legitimate interest would be a better approach here. TX guys.
    – BlizzPort
    Mar 28, 2019 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .