GDPR and CDN (content delivery networks)

Question

I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.

A CDN is, basically, a distributed network of servers. That means that a copy of my website would be hosted on several servers around the world. User requests are (ideally) directed to the server which is closest to the user. By doing so, a CDN improves the performance of the site.

How is this relevant concerning the GDPR?

1. By using a CDN I'm adding to the system a new third-party that will collect the IP and other metadata from my users. Obviously I can't get consent from the user beforehand: when they hit the server it is already too late.

2. Probably, users will get routed to a server close to them, but this is not guaranteed. I don't know to which server they are going to connect. I don't even know the country. It could be that a German user end up sending his IP, browser footprint, etc. to a server in Japan (unlikely but possible). Because I don't know it, I can't inform the user about it.

My assumptions are:

1. Without CDN, the hosting provider would collect that same data so I don't think there is a relevant difference. I just need to inform my users in the privacy policy which CDN provider I use and that it collects personal data on the basis of legitimate interests (Art.6(1)(f)), as I do with the hosting provider.

2. Because there is a potential transfer of personal data out of the EU, I must ensure that the DPA that I sign with the CDN provider includes the SCC. Also, I must inform the users about this possible data transfer in my privacy policy.

Are my assumptions correct?

Is there, in the frame of the GDPR, any other aspect to take in consideration when using a CDN?

Answer 1

Are my assumptions correct?

Yes, this is precisely the sort of thing that would fall under the purview of "the purposes of the legitimate interests pursued by the controller or by a third party", as it fundamentally enables you to deliver the service to the data subject, and its also difficult to argue that "such interests are overridden by the interests or fundamental rights and freedoms of the data subject" given its a fundamental part of delivering the service before any consent can be given.

Its not the intention of the GDPR to solely require a direct relationship between the data controller and data subject, its intention is to allow the data subject to control more of the relationship than they did previously - in some cases, that control remains with the data controller, which is why not all of the lawful basis for processing rest on consent.

So long as you ensure that the CDN provider has a relevant privacy policy and is identified as a data processor in your privacy and data policy then you are good to go.

In my mind, this is similar to the issue of how the data subjects packets get to you from their computer - we aren't including all of the network providers who carry the packets between the data subject and the processor (despite the fact that those providers will have access to much of the same information as the CDN, such as IP address, source, destination etc), even though in many cases we don't know that information (for example which route it will take over the internet). The only difference here is that as the data controller, you know about the CDN and can include it in your policies, so you should.

Answer 2

Yes, as long as they agree to the privacy policy it is acceptable.

If they are not allowed to agree or view the policy it would be a violation.