I would like to build a software application; a party planner, that allows the user to register his guests and RSVP.

Managing a guest list of 50-100 people can be tough, and a tool would help out a lot.

But the user would enter private information about other people, without their consent. Obviously, the information would be kept safe, and not be used to any other purpose than what the user decides, and can be deleted/wiped at any time.

I suppose this is the same use case for CRM systems and event registration systems.

How would my application be affected by GDPR and similar laws?

The information the user enters is not supposed to be owned by me, and I have no right or say over what is entered.

  • 1
    You might want to look up what the difference is between a Data Controller and a Data Processor - you can be both, one or the other, or neither, and they have different obligations. – Moo Apr 7 '20 at 22:58
  • @Moo Yes I think you are right. I looked into how existing applications get around this. And they state that the user is the data controller/processor. – André Snede Apr 7 '20 at 23:32
  • 1
    The service itself might be a processor, but the user is almost certainly the controller in this instance. – Moo Apr 7 '20 at 23:33
  • I am no the one who downvoted your question but it certainly is too broad. You might want to take a look at the GDPR and narrow down the scope of your question. Also, your mention of GDPR suggests that this matter most likely is somewhere in the EU, but asking about "similar laws" prompts the question of what jurisdiction you are interested in. Thus you should clarify that as well. – Iñaki Viggers Apr 8 '20 at 10:49
  • @IñakiViggers Moo already answered my question – André Snede Apr 8 '20 at 14:17

The GDPR does not require the consent of the data subjects for processing. The GDPR requires that you have a legal basis for processing per Art 6. Here, there might be a legitimate interest for processing, in particular the legitimate interest of the party planner. Before relying on legitimate interest as a legal basis, you must do a balancing test to ensure that the legitimate interest outweighs the affected rights and freedoms of the data subject. You should also implement safeguards to limit abuse.

However, a key GDPR principle (Art 5) is transparency. Putting up a privacy policy on your website is not good enough, and Art 14 lists various information that you must provide to the data subject if you didn't obtain their personal data from the data subject themselves. You must provide this information within a reasonable period, but at the latest:

  • within one month
  • at the time of the first communication with the data subject
  • when the information is disclosed to a third party

Here, it seems likely that your system would send out invites to all involved persons. In that invite, you should also make the Art 14 information available, in particular the information that the data subject can object (Art 21) to further processing: legitimate interest means opt-out.

The point of being a data controller vs a data processor is a good one, but doesn't quite apply here. A data processor is bound by some contract per Art 28, which is common/necessary in a B2B context. You could structure your signup flow so that such a contract is formed with the party planner, and the party planner would then be the sole data controller who would be responsible for selecting a suitable legal basis and providing information to data subjects.

But don't do that. Such terms would likely run into consumer protection issues and might be unenforceable. Being a processor is also not a get-out-of-jail-free card, because you still have substantial compliance obligations towards the controller.

More reasonably, you and the party planner are joint controllers per Art 26. The party planner is responsible for legally sharing the data about guests with you and for the processing they do, and you are fully responsible for any data processing or storage you do. This is the model under which consumer-facing internet services generally operate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.