5

I have created an App at helpathome.me which isolated people can use to fill out a form and request help from others.

enter image description here

I innocently thought this would be fine but a friend told me that I must comply to GDPR rules and that when it goes live it shows information directly to the public which could be used inappropriately.

Further more he said that if some not so nice person was to use the data of somebody asking for help and then go to their house and commit some type of crime then I would be liable because I provided the facility for them to meet.

I really want to role this out in my local area (maybe larger area if I have the resources to manage it) but before I do I want to make sure I'm not setting myself up for some nasty legal issues. I would also like any recommendations as to what I can do if anything to the app to make it more secure and compliant) Thanks . I am in the UK

  • 15
    There have been reports in the UK of scumbags getting entry to the homes of vulnerable people by claiming they are from the NHS and are doing free Coronavirus tests (and then robbing the home owners). So this is a very realistic fear. – gnasher729 Mar 21 at 15:34
  • 1
    Bummer. I did not know that. What a world we live in. Ok I need to think of a way to hide the data from the general public and maybe vet those who offer assistance. Thanks for your response. – Bwizard Mar 21 at 15:49
  • 6
    So basically, you want to create a database of vulnerable people that anyone can access by pretending to "assist?" I'll assume your motive was to do something constructive, but you would be giving every criminal who wants it a free list of phone numbers and/or email addresses of people to target. – alephzero Mar 22 at 3:09
  • 3
    @Bwizard yes, that is the problem, unfortunately. That is why such apps are better suitef for use by some registered charity or local neighbourhood organisation strictly internally, rather than just as a public app. – Gnudiff Mar 22 at 10:44
  • 3
    @Bwizard You were naive. IMHO just turn this off now. First you would have to solve the issues of how to vet assisters and people requesting help, which is probably not something a single-person can do at all since it will probably imply human verification of ID documents etc.. – Bakuriu Mar 22 at 10:59
15

Yes, GDPR applies:

  • you are a data controller established/living in the UK or are offering services to people in the UK
  • you fall under the material scope of the GDPR. The Art 2(2)(c) exemption for “purely personal or household activity” does not apply since you're offering the service to the public.

You must consider GDPR compliance here. This is especially important as you are showing personal data to the public. Don't do that unless you have a very good reason, appropriate safeguards, and are clear to users how their information will be shown.

On a high level, GDPR compliance involves working on the following questions:

  • For what purpose are you processing personal data?

    Context: purpose limitation principle per GDPR Art 5(1)(b)

  • What is the legal basis for processing?

    GDPR Art 6(1) lists the available legal bases. Here, consent, necessity for performance of a contract, or a legitimate interest could be a legal basis. They may have further obligations attached. A legitimate interest requires a balancing test that considers the data subject's rights and freedoms. Consent must fulfil the conditions per Art 7 in order to be valid.

  • What is the minimal data necessary to achieve the purpose?

    Per the Art 5(1)(c) data minimisation principle, it is illegal to process personal data beyond what is necessary and adequate. You must provide data protection by design and by default per Art 25. Special categories of data per Art 9 such as health data are illegal to process outside of narrow exemptions. You must delete data once it is no longer necessary.

  • What appropriate safeguards and security measures should you apply?

    Per Art 24 and 25, you are responsible for determining and implementing appropriate measures. This depends a lot on your specific context, so there's no checklist you can apply. Per Art 25(1) you must pseudonymize the processed information if that is compatible with the processing purpose.

  • What further compliance measures do you have to consider?

    There are additional GDPR and non-GDPR compliance measures. From the GDPR side:

    • Use the answers to these questions to write a privacy policy, including the information that you must provide to data subjects per Art 13.
    • Consider whether you have to maintain a Records of Processing document per Art 30, or if you have to make a Data Protection Impact Assessment per Art 35.
    • If you use third party services, figure out whether they are a joint controller or data processor and apply appropriate safeguards.
    • If you have data processors, ensure that you have a contract in place that covers the items from Art 28(3).
    • If you share data with other controllers (not processors) you need a legal basis for doing so.
    • If you transfer data into a non-EU/EEA country (after 2020: non-UK country) you need a legal basis per Art 44 and have to cover additional items in your privacy policy. Ideally, the target country is covered by an EC adequacy decision per Art 45. For US-based companies, this is the case only when they have self-certified under the Privacy Shield framework.

    Non-GDPR compliance steps could include cookie consent banners, or showing a VAT ID.

  • How can you prepare for data subject requests?

    Data subjects have various rights per Arts 15–23, subject to the modalities in Art 12. For example, a data subject could request that their information is erased from your website. The exact rights also depend on the legal basis you selected. You should figure out in advance how to deal with such requests.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.