Storing chat messages in a private database with user consent

Question

The Situation

I am currently creating a Telegram bot for me and some friends that stores all chat messages we send in our group chat in a database so that we can retrieve advanced chat statistics. I live in Germany.

---

Arising Questions

Now my first question is if it would be legal to save group chat messages from my friend group, regarding that:

• everybody orally agreed to me storing all the messages on my private server
• I have access to all the messages anyway since they are stored on the Telegram servers and I can read them from my account whenever I want, so I'm at least not reading any messages that are not for my ears

Because Telegram Bots are publicly available and can be used by anybody, another question arises: If another person I don't know uses the Bot to get chat statistics, could I get in legal trouble for storing their messages even though I explicitly stated that said data collection is necessary and ask for their consent?

• If so, could I take measures to prevent this while still letting anybody who wants use the bot? Or would I be better off just hard-coding that only messages from me and my friend-group can be stored?
• I don't want to collect tons of private messages from random strangers and wouldn't advertise the bot or anything. This is more about the theoretical possibility that anybody who wants to, could hypothetically message the bot even though it is not meant for them or invite it in their group chat and their messages would of course be stored as well.

My vision for the Bot would be (since I believe that chat statistics might still be an interesting feature for many group chats) to offer the source code on GitHub along with some setup instructions so that anybody can set up their own personal instance of the statistics bot on their own private server with their own database. Could I then still get in legal trouble for providing the source code that others could possibly use to store large amounts of private chat data from third parties (or would that be entirely their fault)?

Answer 1

As long as the bot is only used within your friend group, this arguably counts as “purely personal or household use” so that the GDPR does not apply, see Art 2(2)(c).

If the bot can be used more widely, things get more complicated.

If you make the bot software freely available, I'd argue that whoever runs the bot is the data controller and is responsible for GDPR compliance. You are not the controller because you don't decide how this software will be used. (I've heard alternative theories that whoever controls the features of the software would be the controller, but this is nonsensical in the general case.)

If the bot instance that you run is accessible outside of your friend group, then GDPR compliance becomes a concern for you. For example:

• As a controller, you have a general obligation to ensure the security and lawfulness of the data processing (incl. storage/collection). Compare Art 24.

• Lawfulness requires a legal basis, see Art 6. Consent is only one of these, but seems appropriate here. When you collect consent, the consent must be free and informed. You must also make it easy for anyone to withdraw their consent later.

• When you collect personal data from a data subject, you must provide certain information to the data subject at the time of collection. This is usually done in a privacy policy. The required items are listed in Art 13 and formatted as a checklist in the ICO's guide on the right to be informed.

  ^{The ICO's guidance is not binding for you, but unlike most Datenschutzbeauftragte of the German Bundesländer they have good online material.}

• You will have to respond to data subject requests e.g. when they want to exercise their right to access or erasure.

In your situation, I would not want to take on all of this responsibility for a hobby project. Instead, consider whether you can put your friends on a list of users with whom the bot will interact, and have the bot ignore any other users.

Answer 2

There are several distinct issues here.

First of all, you are free to store chat messages on your private server provided that all participants know and consent. If a new person joins the group, they must be notified and given a chance to freely consent to such storage. If they do not consent, messages from them should not be stored. A record should be kept of when each person gave consent.

There should be a reasonably easy way for each person to withdraw consent. If consent is withdrawn, messages from that person should be deleted, unless this is impractical, or unless there is some other lawful basis to retain the messages. (This is required by the GDPR, which it seems would apply.)

Second, You are free, to the best of my knowledge, to write code to accomplish these tasks, provided it is withing the Telegram terms of use.

If your code is published so that othes can use it, they are responsible for what they do with it, provided they must actively run the code, it is not something that works automatically for them.

As a matter of good practice, the code should not bypass any restrictions on access to any messages. If a person does not have access to a give message without your code, that person should not have access with your code. If all the messages are public for anyone to read and copy at any time, it is up to the Telegram people to notify users of this, and your proposed code is merely assisting others to do what they could do on their own, if they knew how.

It would be good practice to warn others of their responsibilities to notify and obtain consent from those whose messages would be stored, and to handle withdrawal of consent. But that is up to anyone who chooses to use your code, and yiu are not liable if they fail to comply with the law.

If your code does not in fact store messages, but only statistics about messages, and does not store information identifiably abut any specific person, then i don't see any privacy issues with it. But the question seems to say that actual copies of chat messages would be stored.