GitHub pages and GDPR - controller, processor and DPA

Question

I want to set up a very simple static site (no Google Analytics, no forms, no cookies, no tracking) using GitHub Pages with a custom domain.

The only potentially personal data that the site will collect is the IP and the browser footprint.

My questions are:

1. I am not who "determines the purposes and means of the processing of personal data". Actually, I will have no access to that IPs (GitHub collects them and, AFAIK, they don't provide any logs): am I still the data controller and GitHub the data processor?

2. If I am the controller, do I have to sign with GitHub a DPA (Data Protection Agreement)? It seems to be a little bit overkill in this case.

Answer 1

If you publish a website, you are the data controller for this website. Serving a website necessarily implies processing (but not collection) of personal data.

You have chosen to host your website on GitHub Pages. Is GitHub then a joint controller with you, or is GitHub your processor with which you sign a DPA?

In 2019, I asked GH customer support about this. Their response:

Our Privacy Statement, combined with our Terms of Service, is intended to serve as a data protection agreement for individual accounts — we specifically wrote our Privacy Statement to provide the information required by Article 28 of the GDPR, including a list of our subprocessors. Our Privacy Statement and our Terms of Service serve as our agreements with you, as the controller, instructing us as the processor, and you can always contact us to provide additional instruction. Should we receive a data subject request that relates to data we process on your behalf, we'll always let you know promptly and work with you to comply.

— Github, 2019-04-10, private communication

At the time, their Privacy Policy described GH Pages as follows:

If you create a GitHub Pages website, it is your responsibility to post a privacy statement that accurately describes how you collect, use, and share personal information and other visitor information, and how you comply with applicable data privacy laws, rules, and regulations. Please note that GitHub may collect Technical Information from visitors to your GitHub Pages website, including logs of visitor IP addresses, to maintain the security and integrity of the website and service.

(Update 2022: the privacy notice has since changed, and the quoted part is no longer part of the privacy notice.)

Under this theory:

• you are the controller, and GH is your processor
• the terms of service incl. GH privacy policy form an effective Data Processing Agreement
• you have instructed GH to collect Technical Information in the sense of the privacy policy, for the purpose of maintaining security and integrity of the website, which can be covered by legitimate interest
• you have not instructed/allowed GH to process any other data from your site

It is your call whether you subscribe to that theory. Note that GH organizations can opt-in to their corporate terms and sign an explicit DPA which will mostly contain the same provisions.

Does it matter that you don't have access to the Technical Information? No. Being a controller means that you decide the purposes and means of processing, not that you store data. You as a controller can always decide to point your domain name to a different server if you no longer want to use GH as a processor.

Answer 2

You are right that you are not the controller, because you do not collect or process the info.

If something on Github or any other site requires a DPA or other info in regard to the GDPR, it is up to that site to provide it, not you.

IP addresses are considered identifiers though and the GDPR would apply if you were the one collecting them.

A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant. https://eugdprcompliant.com/personal-data/