2

I'm building a website for a client (a hotel) in Germany. In addition to a bunch of static pages, this website will also host a reservation system which is provided by a 3rd party software company in the form of a single page application. You just have to include their javascript snippet that builds up the whole system/website. Then it's basically a self-contained website, including a footer etc.

They're using all kinds of technologies that a user would like to be informed about in a privacy policy (Google Analytics, Google Fonts, Social media plugins). The problem is: They're not providing a privacy policy on their own and the support argues that it's the responsibility of the web developer to author this privacy policy themselves.

Question: Given that the 3rd party basically provides a whole website (including header and footer) aren't they obliged to deliver a privacy policy too?

Question: Who would be liable in case the privacy policy is incomplete in respect to the technologies used on the 3rd party software?

3

Unless there's a data processing agreement between the hotel and the third party, both would likely be joint controllers. I.e. the hotel is fully co-responsible for any data processing that happens due to any embeds. If there were an Art 28 data processing agreement, the hotel would be fully responsible as well, but would have the primary responsibility for ensuring compliance – if the third party is a data processor, they don't have to publish their own privacy policy.

This view is supported by the ECJ C-40/17 “Facebook Like-Button” case. A fashion retailer included the FB like button on the web page. The court found that the retailer was not a controller of subsequent processing by Facebook (here, Facebook is its own controller). However, the two parties are joint controllers for collecting and transmitting the personal data on the page.[1] While the ruling was made under the previous Data Protection Directive, it is entirely transferable to the GDPR. In your scenario the on-page processing is even more substantial.

[1]: Which means that the website needs a legal basis for sharing data with the embed provider. For like buttons, the typical legal basis is consent, and loading the social plug-in is deferred until the visitor consents. This is more tricky for a reservation system because service may not be conditional on consent per Art 7(4).

The definition of a data controller is the party “which, alone or jointly with others, determines the purposes and means of the processing of personal data”. The hotel is clearly a controller here because it decides purposes and means. Using the third party embed is a means for the purpose of making reservations. The hotel has a responsibility to ensure that the purposes and means are in compliance with the GDPR.

It seems like the third party the hotels wants to use is not prepared to act in a GDPR-compliant manner, or to enable its customers to achieve GDPR compliance. Another reservation system should be used, or a the hotel should set a link to the reservation system's own web page, to make it clear that they are not responsible.

4
  • Many thanks, that's very valuable information! I'm particularly interested in my liabilities as a developer. A webdev is responsible that the delivered endproduct (the website) is legally flawless: no copyright infringement, a valid imprint, and also a GDPR compliant privacy policy text. If I build everything myself I'm able to comply because I know what I'm doing. But when I use this 3rd party I don't have full insight of what they're doing regarding private data in their software, who would be liable in case I forgot to mention sth in the privacy policy? – Alexa Apr 1 '20 at 17:49
  • I should have phrased my original question more clearly. The focus of my question is actually the liability with regards to an incomplete privacy policy. – Alexa Apr 1 '20 at 17:50
  • 2
    @Alexa The controller is responsible for compliance and can't farm this responsibility out to a contractor. GDPR compliance is more about proper processes than perfect privacy policies. The hotel would also be unwise to take legal advice from a dev. However, you can assist them with compliance, e.g. by pointing out that certain items in the privacy policy are necessary but cannot be known by you. Whether you are liable is going to depend on your contract. – amon Apr 1 '20 at 20:20
  • Thanks. I perfectly agree that GDPR is more than just a valid privacy policy, but as a webdev this is the one aspect that is currently relevant for me. I'm an external contractor for the hotel and the contract I set up is a "Werkvertrag". In this type of contract I'm responsible to deliver a legally flawless product. Afaik it's illegal to reduce liability in a Werkvertrag. – Alexa Apr 2 '20 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.