2

I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.

A CDN is, basically, a distributed network of servers. That means that a copy of my website would be hosted on several servers around the world. User requests are (ideally) directed to the server which is closest to the user. By doing so, a CDN improves the performance of the site.

How is this relevant concerning the GDPR?

  1. By using a CDN I'm adding to the system a new third-party that will collect the IP and other metadata from my users. Obviously I can't get consent from the user beforehand: when they hit the server it is already too late.

  2. Probably, users will get routed to a server close to them, but this is not guaranteed. I don't know to which server they are going to connect. I don't even know the country. It could be that a German user end up sending his IP, browser footprint, etc. to a server in Japan (unlikely but possible). Because I don't know it, I can't inform the user about it.

My assumptions are:

  1. Without CDN, the hosting provider would collect that same data so I don't think there is a relevant difference. I just need to inform my users in the privacy policy which CDN provider I use and that it collects personal data on the basis of legitimate interests (Art.6(1)(f)), as I do with the hosting provider.

  2. Because there is a potential transfer of personal data out of the EU, I must ensure that the DPA that I sign with the CDN provider includes the SCC. Also, I must inform the users about this possible data transfer in my privacy policy.

Are my assumptions correct?

Is there, in the frame of the GDPR, any other aspect to take in consideration when using a CDN?

3

Are my assumptions correct?

Yes, this is precisely the sort of thing that would fall under the purview of "the purposes of the legitimate interests pursued by the controller or by a third party", as it fundamentally enables you to deliver the service to the data subject, and its also difficult to argue that "such interests are overridden by the interests or fundamental rights and freedoms of the data subject" given its a fundamental part of delivering the service before any consent can be given.

Its not the intention of the GDPR to solely require a direct relationship between the data controller and data subject, its intention is to allow the data subject to control more of the relationship than they did previously - in some cases, that control remains with the data controller, which is why not all of the lawful basis for processing rest on consent.

So long as you ensure that the CDN provider has a relevant privacy policy and is identified as a data processor in your privacy and data policy then you are good to go.

In my mind, this is similar to the issue of how the data subjects packets get to you from their computer - we aren't including all of the network providers who carry the packets between the data subject and the processor (despite the fact that those providers will have access to much of the same information as the CDN, such as IP address, source, destination etc), even though in many cases we don't know that information (for example which route it will take over the internet). The only difference here is that as the data controller, you know about the CDN and can include it in your policies, so you should.

| improve this answer | |
-2

Yes, as long as they agree to the privacy policy it is acceptable.

If they are not allowed to agree or view the policy it would be a violation.

| improve this answer | |
  • 1
    This is a very simplistic and therefore misleading answer. Agreeing to a policy is not the same as consent, which is anyway not the panacea some believe it to be. The answer is also very assertive, and could have been better explained with examples of how and why, perhaps referencing the law given that this is the Law SE. Definitely don't let the downvotes put you off contributing, but consider your answers carefully. Good luck! – Sam_Butler Feb 28 at 13:49
  • When I downvoted this answer, I left a comment to explain why and give constructive feedback. To have that comment then downvoted is not in the spirit of this platform. – Sam_Butler Mar 9 at 9:38
  • @Sam_Butler huh? You can’t downvote comments - I can see your original comment just fine above your one today. – Moo Mar 10 at 8:44
  • Thanks @Moo, not sure what happened then. Showed as -1, now shows as 1 (comment upvotes). Maybe I was being oversensitive! – Sam_Butler Apr 21 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.