2

My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have the right to data portability? There's no data stored for me to send them. If a visitor tried to exercise this right, what should I do as the owner of such website? Just tell them there's no data?

4

You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine.

It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.

  • It's also a chicken-and-egg problem. Informed consent requires you to inform the user what he's consenting to. Which language are you using for that?! – MSalters Mar 28 at 14:46
  • 1
    @MSalters Good point. I haven't thought about that. As Amon said, legitimate interest would be a better approach here. TX guys. – BlizzPort Mar 28 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.