1

What does the GDPR say about personal information provided by a user about themselves, in the case that the service sign-up process and ToS have always asked of the users not to provide personal information about themselves?

Imagine that an Internet service has ToS that request of the user not to divulge personal information, and then some users have divulged personal information of theirs while using the service nonetheless.

Further imagine that the Internet service provides means for free-text communication, so it is very possible for a user to include personal information by chance or in order to make a point even though never solicited for personal information by the service.

Which of the GDPR obligations does the service provider have to undertake or actively fulfill in such case?

  • Hello! Welcome to Law.SE. Please read our tour page. – isakbob Nov 11 at 15:55
  • 1
    I can answer your question, and I believe the answer by wimh to be flawed, but you will need to provide data about whether the Internet Service constitutes an Information Society Service and what information is required in the service sign-up process. – Sam_Butler Nov 19 at 11:43
  • @Sam_Butler I am not entirely sure about the currently single answer given either. I believe it is not an Information Society Service as it does not charge its users. Let us assume it is not then? – matanster Nov 28 at 15:04
1

Imagine that an Internet service has ToS that request of the user not to divulge personal information, and then some users have stored personal information of theirs in the service nonetheless.

Based on article 6(1), processing of personal data is only lawful if a legitimate basis applies:

  1. Processing shall be lawful only if and to the extent that at least one of the following applies: [...]

As the Internet service did not want to process personal data, probably none of those legitimate basis applies, making the processing unlawful.

This means the Internet service must remove the personal data as soon as it knows about it. However the Internet service is not required to actively monitor. This is similar to other kinds of unlawful data, such as copyright violations. (I make the assumption here that the Internet service does not filter content it shows, so all content uploaded by users is shown unmodified).

Which of the GDPR obligations does the service provider have to undertake or actively fulfil in this case?

Basically none. The GDPR does not apply because the Internet service does not know it is processing personal data. (Based on the Tos, it even avoids to process personal data). And after it knows, it removed the personal data. In particular this is not a personal data breach, so those rules don't apply either. The only part that would apply is the right of erasure, in particular Art. 17(1)(d):

  1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

    (d) the personal data have been unlawfully processed;

It would probably be required to have a formal notice and takedown procedure. But that would not be specific for the GDPR.

  • In case the service performs processing on all data provided by the users, then this radically changes the answer doesn't it? – matanster Nov 11 at 10:15
  • No, I don't think that changes the answer. Data processing is any kind of processing of the data, so just showing it is also data processing. Maybe compare it with youtube where a user uploaded an copyrighted song for which youtube does not have a license. Youtube show the video to everyone who opens the page. That is clearly unlawful. When the copyright holder notifies youtube, youtube has to delete the file immediately. However it does not have to pay a fine or license fees for all the times the video was played by someone. In Europe the same rules apply to all kind of unlawful content. – wimh Nov 12 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.