As an individual, not a company, if I collect email addresses of visitors to my website, what gdpr regulations apply to me?

Question

I'm planning on making a website to act as a CV / portfolio of my work as a software developer. I intend to lock this personal data behind a token based access system, so that it isn't available unless someone sends me their email address. Their email address will be stored against a token which is emailed to them, and that token both grants access and allows me to audit access to my personal data. I intend to encrypt the email address and keep the decryption key separately from the server so a data breach should be mitigated against. Do you think GDPR applies to me in this situation and, if so, can I protect or indemnify myself somehow?

Answer 1

The GDPR applies to all data controllers, regardless of whether the data controller is business or non-profit, corporation or natural person. However, there is an exception for purely personal or household purposes.

A CV page comes fairly close to a purely personal purpose, but I don't think this exception would apply: you are not just processing the personal data from family members or close friends, but from members of the public.

If GDPR applies, you need a legal basis for processing personal data. Presumably, you will have to articulate some legitimate interest (Art 6(1)(f)) that outweighs the visitors privacy interests. Per the GDPR's data minimisation principle, you can only process the minimum data necessary to achieve the purpose of processing so you will have to find a good reason why auditing access to your portfolio is so important. Don't forget to provide a privacy policy that conforms to GDPR Arts 13–15, and to prepare for data subject requests such as a right to access or right to erasure.

Perhaps it is simpler to consider alternatives. For example:

• keep a portfolio public, but only send your full CV out manually. Sending out your CV in course of a job search sounds like a purely personal purpose.
• use a social media or job platform where you're not the data controller

Answer 2

No, the GDPR does not apply unless you're under the GDPR's jurisdiction. That's the European Union plus anyone or organization with a legal nexus in the EU. So, if you're not in the EU and your server and the entity (company, etc.) that has the server is not in the EU, you probably don't have the nexus.

Nexus includes citizenship in the EU and, for a corporation or other entity, some kind of charter, registration, etc. in the EU even if the headquarters and all offices are elsewhere.

While the EU would like the world to believe that the GDPR has worldwide jurisdiction, this is not legally possible. The U.S. cannot have a law taxing everyone in the world and 192 other nations also can't have laws taxing everyone in the world, or you'd have to pay taxes to 193 nations and maybe go to 193 jails if you don't pay.

The fact that someone in the EU can see your website, interact with it over the Internet, and send you an email address that is hosted in the EU is, by itself, not enough of a nexus for you.

Whoever you use for your hosting likely has terms of service. Read them carefully to see if that hoster requires GDPR or EU compliance. Some big American companies have the nexus and if you use their servers you have to agree to GDPR. Even if you have your own dedicated server but it's run by a hosting service, if that hoster is under GDPR, so are you.

There is, by the way, no way that someone who has to comply with the GDPR does not have to comply with all EU law, and that brings up all of the other EU laws that might apply. If you have to litigate under EU law and you're not there, plan for the airfare.

(Originally, a moderator answered that the answer is Yes. That is partly what this No answer responds to, but I don't know why that other answer disappeared.)

By the way, your procedure might give you a clue if the re-user is a visitor of yours but not if they sell or transfer it. It might also discourage people you want seeing your CV from taking the extra step and therefore from seeing yoour CV. People can be picky that way. I think about who I give my email address to and whether the benefit is important enough.