2

GDPR, article 4, point (1) states:

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

GDPR, article 6, point 1. states:

Processing shall be lawful only if and to the extent that at least one of the following applies:

[...]

If I develop a pure offline mobile application, do I need to comply with GDPR? Let's say it does ask you for your full name, but only to display your initials. Or something like that.

Alternatively, if I develop a mobile application that does process some personal data on the "backend" (a remote server owned by my company), but some different subset of (potentially more sensitive) personal information is handled purely offline (never leaves the device), do I need to have a lawful basis for processing that data?

I feel that the intention of GDPR is to define "processing" as an action performed by an entity (person, company) either manually or using automated means, when I'm in charge of this data (I can access it, it can be leaked, etc.), so intuitively, offline processing shouldn't be considered "processing" as in GDPR. On the other hand, the definition in Article 4 is so broad that it feels like it does include offline processing.

Improve this question
2
  • 2
    Its not clear what you mean by "offline". Do you mean that all the processing (e.g. extracting initials from name) happens on the user's device? If so that is better known as "local" processing. "offline" means "without a connection to another machine", which could apply to either end.
    – Paul Johnson
    Commented Jul 1, 2020 at 15:56
  • Yes, I meant locally on user's device!
    – cubuspl42
    Commented Jul 1, 2020 at 16:06

3 Answers 3

Reset to default
1

The GDPR only applies to data processed by you on your computer. Any processing that happens on the user's device is the user's responsibility, not yours.

Improve this answer
6
  • 1
    Well, that's was also my intuition, and I shared that in the question. But could you explain why? Does some other part of GDPR specify that? Like I said, the processing definition itself is so broad that it, ironically, does seem to include local processing.
    – cubuspl42
    Commented Jul 1, 2020 at 16:08
  • @cubuspl42 Its a good question. I can't find anything which specifically addresses this point either, and its not the first time the question has come up. I do see what you mean about Article 4, particularly given the fact that the Data Controller can have the processing done by someone else. What if that someone else is in fact the app user? One way forward would be to write to the ICO (assuming you are in the UK) and ask the question, adding that you plan to post their reply here.
    – Paul Johnson
    Commented Jul 1, 2020 at 16:53
  • The first question should be "who is the controller?". Based on Art. 4(7) the controller determines the means of the processing of personal data. I think that means the user who decides to use your software to process data is the controller. The controller is responsible to use only software which complies with the GDPR (see Art. 24(1)). There are situations where two parties are joint controllers. For example when creating a fan page on facebook, the creator and facebook are joint controllers.
    – wimh
    Commented Jul 1, 2020 at 18:24
  • @PaulJohnson I'm not located in the UK, unfortunately.
    – cubuspl42
    Commented Jul 1, 2020 at 21:03
  • 1
    That is actually wrong. Any data storage that happens on the users device is subject to the ePrivacy Directive (to be replaced by the ePrivacy Regulation).
    – user9838
    Commented Aug 1, 2020 at 10:19
1

Processing does not have to be by computer

Purely paper based records are also subject to the GDPR.

Improve this answer
2
  • 1
    Thank you for your answer. I'm not sure how is it relevant, though. I asked about pure-offline (no Internet access) mobile applications, not about paper records or non-automated processing of any kind.
    – cubuspl42
    Commented Jul 2, 2020 at 7:25
  • @cubuspl42 For all it could be engraved in stone slabs put out on the marketplace and you'd still you need to follow GDPR rules and work with the frameworks. If you ain't the controller, you ain't the controller.
    – Trish
    Commented Aug 1, 2020 at 6:59
1

It is important in this context to determine who the Data Controller is. This role is defined in Art 4(7) (highlight mine):

‘controller’ means the natural or legal person, […] which, alone or jointly with others, determines the purposes and means of the processing of personal data; […] the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Since you as the app developer clearly control the means of processing, you are the data controller. The means you have chosen is “offline processing” which is a strong safeguard and drastically simplifies your compliance, but it is still processing under your control. Who controls the processing is more important than where and how the processing is performed.

The only scenario I can envisage in which you would not be the data controller is if someone else is the data controller, and you are their data processor per Art 28.

I have written more in-depth analysis on this issue in my answer to Does the GDPR appy to the data subject's computers?. The ECJ's ruling on the Fashion ID case is useful to determine when someone is a (joint) controller, even if they do not have access to the data being processed.

Improve this answer
11
  • 1
    Thank you for your answer. While the reasoning sounds reasonable, I don't understand how can offline (local) software be made compliant. Let's say my app saves the personal data in the local device storage. How can I comply with Article 15, point 1): "The controller shall provide a copy of the personal data undergoing processing."? How can I provide a copy of something I don't have access to?
    – cubuspl42
    Commented Jul 1, 2020 at 20:49
  • 1
    But, maybe, when I'm contacted by a user which wants their data to be erased, or object to the processing, I can provide them with... instructions? "If you object to processing, please press "Delete locally-stored personal data" button in the settings.". But I don't know if that's complaint, it doesn't sound like. I understand these articles (15, 17, 21, ...) as if I'm obliged to just handle the request, not tell the user "I can't do that. Do that yourself. I don't know if you actually will, but you technically can. I guess I handled your request."
    – cubuspl42
    Commented Jul 1, 2020 at 20:59
  • 1
    @cubuspl42 Yes, I think pointing users to self-service options is appropriate. The GDPR does not require you to process extra data just to be able to respond to data subject requests. Detail notes: Access also requires you to provide information in addition to the data, but you'd typically provide the info up front as part of your privacy policy. Consider also the relationship between Access and Data Portability (Art 20), which is typically satisfied by an export feature. Objection only applies if your legal basis is legitimate interest.
    – amon
    Commented Jul 1, 2020 at 21:03
  • 1
    @cubuspl42, hmm, if you don't determine the purposes of processing that is actually an indication that you aren't the controller. Having a clear purpose is a precondition for finding a suitable legal basis. But providing a service to users is a purpose…
    – amon
    Commented Jul 2, 2020 at 7:29
  • 1
    For the camera example I think that it's irrelevant that the photos could contain sensitive information because the camera only processes it as a photo, and doesn't extract the sensitive data. Consent may be still be appropriate, not only because it's part of the permission work flow on mobile devices, but because it gives you minimal rights (users consent to a specific purpose, and you can't decide to process the data for a different purpose). For a paid app, “necessity for performance of a contract” would also work.
    – amon
    Commented Jul 2, 2020 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .