I'm developing an application for mobile/web/desktop that will (in very watered down basic terms) store free text strings they've self-contributed and access them freely.

As it stands, these applications can run without processing data and storing everything locally on the device. However, if I want to save the users data to a server in order for them to load the same information on multiple devices, I will be storing and processing data.

The reason I'm hitting a brick wall in trying to track down the legal issues involved here are twofold:

  1. If the developer is based in the EU and the server is based in the US, which jurisdiction does this fall under?
  2. If I'm storing just an e-mail address and unique identifier key in the database for login, would this in itself, be identifiable information? Would a user storing the text string "Mop floor tonight" be considered personal data? I ask because as this is free text, I'm aware a user could essentially type "My name is Dave Smith and I live at 742 Evergreen Terrace" and suddenly that's very personal data.

I'm just trying to get my head around the risks/efforts involved in having a simple "sync to all devices" command that can be manageable by a 1 person developer team. Are there perhaps exemptions for small businesses whose IP is the code itself and not the data (i.e., I'm just collecting a username/email for login, no other data, not writing to the e-mail or using that data to generate revenue etc), and the self-supplied data is essentially just there to enable a feature? Or is this a legal framework I'll have no choice but to consider globally for all users?

  • Where are the data subjects?
    – Lag
    Jun 3, 2020 at 15:50
  • Hi @RazorKillBen, I am voting to close because this question is asking for legal advice. Please generalize the question if possible.
    – Andrew
    Jun 3, 2020 at 17:35

2 Answers 2

  1. If the developer is based in the EU and the server is based in the US, which jurisdiction does this fall under?

Every jurisdiction where the app is accessible. So, pretty much every jurisdiction.

  1. If I'm storing just an e-mail address and unique identifier key in the database for login, would this in itself, be identifiable information?

Yes. Email addresses are personal information.


If your app is "targeted" at residents of the EU and anyone currently located in the EU uses your app, the GDPR will apply. If the application operator is located in the EU, the GDPR will apply. If anyone who is a resident of California uses the app, the CCPA (TITLE 1.81.5.) will apply. The data protection and privacy laws of other countries may well apply as well.

Under Article 4 section (1) of the GDPR:

personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

This means that under the GDPR an Email address is definitely personal data. An IP address is usually personal data. Anything that relates to a user that can be identified is also personal data.

An email address is also personal information under the CCPA.

Under GDPR article 6 there must be a lawful basis for processing (which includes storage) of any personal information. The most likely basis for the situation described in the question is the consent of the data subject. Consent must be freely given, and may be revoked at any time.

Under CCPA section 1798.100 (a), a business that collects personal information must inform consumers of:

  • (1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared.
  • (3) (3) The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.

Under Article 15 of the GDPR a data subject has the right to ask what information the data controller is processing (including storing). The CCPA provides a similar right under section 1798.110. Under Article 17 of the GDPR a data subject has the right to request that the data controller delete such information. The controller must comply unless there is another lawful basis for continues processing. There are some complexities in regard to when a controller may decline such a request. The CCPA provides a similar right under section 1798.105.

In short an application operator must respond to questions from users about what information the app has on file about a particular user, and how it is used, and must delete such info on request unless there is good reason to retain it. details vary.

Under Article 24 of the GDPR

  1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
  1. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

Under CCPA section 1798.100 (e)

A business that collects a consumer’s personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.

In short an operation must use reasonable security measures to keep user information confidential, except where users have agreed to it being made public. What is reasonable will depend on the nature of the app, and the kind of information it is likely to process an store.

It is good practice to generally indicate what information is secured, and the overall degree of security in use, but not the specific measures taken. If information is not highly secure, users should be aware of that before they entrust highly sensitive data to the app.

Neither the GDPR nor the CCPA provides any exceptions for "small" controllers/businesses/operators, although the GDPR provides an exemption for "household" use. That would not apply when any person on the net is able to register an account and use the app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.