My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have the right to data portability? There's no data stored for me to send them. If a visitor tried to exercise this right, what should I do as the owner of such website? Just tell them there's no data?
1 Answer
You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine.
It is also curious that you are using consent as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that legitimate interest would be a much more straightforward approach in your case.
-
1It's also a chicken-and-egg problem. Informed consent requires you to inform the user what he's consenting to. Which language are you using for that?!– MSaltersMar 28, 2019 at 14:46
-
1@MSalters Good point. I haven't thought about that. As Amon said, legitimate interest would be a better approach here. TX guys. Mar 28, 2019 at 18:51