2

In this answer to a GDPR question about processing conducted by an app on the user's computer I wrote:

The GDPR only applies to data processed by you on your computer. Any processing that happens on the user's device is the user's responsibility, not yours.

To which the OP replied:

But could you explain why? Does some other part of GDPR specify that?

I looked through the ICO website, but to my surprise I failed to find an answer. It looks as if the drafters of the GDPR did not consider the question.

So: if I write a program which is run by the user on their own computer, and which is designed to process the user's personal information solely on that computer, does that processing make me a Data Controller for GDPR purposes? Answers must cite judicial rulings or regulations which directly address the question.

Note in response to comments: there are other laws and regulations that might apply, but here I am only interested in the narrow question of whether the GDPR can be definitely ruled out as not applicable.

  • So: if I write a program which is run by the user on their own computer - could that be any program (like a spreadsheet) or is the program's purpose to process personal data? – wimh Aug 1 at 11:00
  • That probably depends on if the data is entered by the user themselves, or if the program generates and stores any metadata (like app ids, idfas, cookies if the app includes a browser etc.) in which case the program would be subject to the ePrivacy directive. So without clarification, this is probably not answerable. – Eike Pierstorff Aug 1 at 11:58
  • @wimh Its designed to process personal data. E.g a fitness tracker, or a mapping program that records GPS locations. Question edited to clarify. – Paul Johnson Aug 1 at 12:34
  • @EikePierstorff Cookies and their relatives are subject to other legislation and are also transmitted off the user's device, so lets leave them out of it. – Paul Johnson Aug 1 at 12:36
  • @PaulJohnson, yes, the "other legislation" would be the ePrivacy directive, which regulates storage of data on users devices. I did not mean to answer your question about the GDPR, I was pointing out that the GDPR might not even be the pertinent law here. – Eike Pierstorff Aug 1 at 12:41
2

The GDPR applies regardless of where and how data is processed. But it is necessary to look at what the processing activities in question are, and who is the controller for these activities by determining their purposes and means. This argument is supported:

  • by the absence of relevant exemptions in the GDPR
  • by the GDPR's broad definition of the data controller
  • by the ECJ's analysis in the Fashion ID case

GDPR Exemptions

For certain constellations (e.g. controller = natural person, purposes = purely personal or household activities) that processing is exempt from GDPR compliance (see GDPR Art 2(2)). However per GDPR Recital 18, the GDPR would still apply “to controllers or processors which provide the means for processing data for such personal or household activities.”

For example, this means that I am able to use WhatsApp to process my friends' contact information for purely personal purposes because I'm exempt from the GDPR with respect to that processing, but Facebook is still subject to the GDPR regarding how they process personal data collected via WhatsApp.

Already on the basis of the GDPR providing no exception for processing on someone else's computer, I disagree strongly with the answer you cited (and have already written a competing answer). It seems entirely counterfactual.

How to figure out who the controller is.

Per GDPR Art 4(7), controller is whoever “alone or jointly with others, determines the purposes and means of the processing of personal data”, although other laws might provide more specific criteria for individual purposes or means.

We will return to that definition in the next section.

The ICO has provided a checklist to figure out if you're a data controller or perhaps a joint controller. Some of the questions are aligned with the above definition, like “We decided what the purpose or outcome of the processing was to be”. Other questions are there as a contrast to the data processor role, e.g. “We have complete autonomy as to how the personal data is processed”.

Analysis of the Fashion ID case (ECJ C-40/17)

This judgement provides a detailed analysis of who the data controller is, and is therefore relevant to the question. Fashion ID had embedded a Facebook “Like” button on their website, thus causing the visitor's browser to transmit personal data to Facebook. Fashion ID asserted that they were not the data controller, since they had no control over what data was collected by the Like button and how it was subsequently used by Facebook. Fashion ID relied in part of the argument that they weren't the controller because processing happened on the visitor's computer.

This ruling was made on the basis of the Data Protection Directive 95/46 which was repealed by the GDPR. However, since the DPD and GDPR have effectively identical definitions of “controller” and “processing”, the court's analysis remains highly relevant. In the following I'll “translate” all DPD references to the GDPR, in analogy to GDPR Art 94(2).

The court found that Fashion ID was a data controller for the processing by the Like button, and that it was a joint controller with Facebook for this processing. However, Fashion ID was only a controller for those processing activities in which they played a part, not for subsequent processing of the data that was controlled by Facebook alone.

Relevant details from the Judgment (ECLI:EU:C:2019:629):

  • Paragraphs 65–66: The GDPR tries to achieve a high level of data protection through a broad definition of “controller”.

    • Thus, an overly narrow interpretation that counteracts this goal is incompatible with the law.
  • Paragraph 68: An entity is a controller when it exerts influence over the processing for its own purposes, thereby participating in determining the purposes and means of processing.

    • Compare the GDPR Art 4(7) definition of “controller”.
    • case law: C-25/17 Jehovan todistajat, ECLI:EU:C:2018:551, paragraph 68: “However, a natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller”.
  • Paragraphs 67, 69–70, 82: It is not necessary to have a single controller, there can be multiple joint controllers. The joint controllers can be involved to different degrees. You can be a joint controller without having access to the personal data.

    • case law: C-25/17 Jehovan todistajat, ECLI:EU:C:2018:551, paragraph 69: “Furthermore, the joint responsibility of several actors for the same processing, under that provision, does not require each of them to have access to the personal data concerned”.
    • case law: C-210/16 Wirtschaftsakademie Schleswig-Holstein, ECLI:EU:C:2018:388, paragraph: 38: “In any event, [GDPR] does not, where several operators are jointly responsible for the same processing, require each of them to have access to the personal data concerned.”
  • Paragraphs 71–74: Processing can consist of many different individual activities. A controller might only be involved in some of them, and can only be a controller for those activities for which they (jointly) determine purposes and means of processing.

  • Paragraphs 76–79: Fashion ID was able to determine the purposes and means of processing regarding data collection and transmission by the Like button. The act of embedding the button showed that they had decisive influence over the processing: without the embedding, the data processing would not have occurred.

To summarize the relevant conclusions:

  • someone is a data controller when they participate in determining the purposes and means of processing for some processing activity
  • for joint controllers, this holds regardless of whether they have access to the data or participate in the processing itself
  • one cannot be a controller for a processing activity for which they cannot determine purposes and means.

Conclusion and application to the question

This analysis reaffirms my competing answer to the cited answer that it is important to determine who the data controller is. The Fashion ID case shows that is important to perform this analysis on a fairly granular manner, on the level of individual processing activities.

For processing on a data subject's computer by a program written by another provider, this means:

  • some processing activities might be solely under the user's control, then they are the sole data controller (or might be exempt from GDPR)
  • for some processing activities, the software developer might decide alone for which purposes and through which means the processing is carried out
  • for other activities, the user and data controller might be joint controllers. This does not require explicit agreement but can result implicitly. This does not require that the software developer has access to the personal data undergoing processing.

For example, a spreadsheet application might be used by an end user to process personal data on their own computer (or via a cloud application, with the same conclusions). We can consider different processing activities performed by the software:

  • sorting, transforming, and other processing of the data in the spreadsheet is solely under the end users control, so they are the data controller (if they aren't exempt)
  • collecting usage analytics (where those analytics signals are personal data for which the end user is the data subject) is solely under the software developers control
  • uploading crash reports (where those reports contain personal data from the end user and contain contents from the currently opened spreadsheet) is more complicated. The software developer is definitely a controller. The end user has a dual role here as a data subject and a joint controller (if they aren't exempt) because the crash report processes personal data for which they are the controller.
| improve this answer | |
1

The EDPB has started a public consultation about the Guidelines 07/2020 on the concepts of controller and processor in the GDPR. (Open for feedback until 19 October 2020). While that document does not directly addresses this question, it contains some pointers.

First assume a software developer which also hosts its own software. (so the software developer is at at least a processor).

  1. [...] When considering whether or not to entrust the processing of personal data to a particular service provider, controllers should carefully assess whether the service provider in question allows them to exercise a sufficient degree of control, taking into account the nature, scope, context and purposes of processing as well as the potential risks for data subjects.

  2. As stated above, nothing prevents the processor from offering a preliminary defined service but the controller must make the final decision to actively approve the way the processing is carried out and/or to be able to request changes if necessary.

Example: Cloud service provider

A municipality has decided to use a cloud service provider for handling information in its school and education services. The cloud service provides messaging services, videoconferences, storage of documents, calendar management, word processing etc. and will entail processing of personal data about school children and teachers. The cloud service provider has offered a standardized service that is offered worldwide. The municipality however must make sure that the agreement in place complies with Article 28(3) of the GDPR, that the personal data of which it is controller are processed for the municipality’s purposes only. It must also make sure that their specific instructions on storage periods, deletion of data etc. are respected by the cloud service provider regardless of what is generally offered in the standardized service.

The way I read this, is that the software developer does not become a (joint)controller because of decisions made in the software. But instead the controller is responsible to use this software or not.

That would also mean if the software developer does not host any part of the software itself, but the software only runs on the device of the user, it will also not be a controller.

The EDPB document also contains some information about the choice of software a processor has;

  1. The question is where to draw the line between decisions that are reserved to the controller and decisions that can be left to the discretion of the processor. Decisions on the purpose of the processing are clearly always for the controller to make.

  2. [...] such as the choice for a particular type of hard- or software or the detailed security measures which may be left to the processor to decide on.

So a processor can choose which software to use, even without telling the controller. As a processor is not allowed to define the purposes and means of any data processing, choosing which software to use does not define the purposes and means. So the software manufacturer will not become a (joint) controller but also not a sub-processor, as a processor is required to inform the controller about that:

  1. [...] the processor must obtain the controller’s authorisation in writing before any personal data processing is entrusted to the sub-processor [...]

Of course this means that the processor is not allowed to use any software which is incompatible with the controller’s instructions. But if the processor does choose such software, the processor becomes a controller, not the software developer;

  1. Acting “on behalf of” also means that the processor may not carry out processing for its own purpose(s). As provided in Article 28(10), a processor infringes the GDPR by going beyond the controller’s instructions and starting to determine its own purposes and means of processing. The processor will be considered a controller in respect of that processing and may be subject to sanctions for going beyond the controller’s instructions.

To summarize;

So: if I write a program which is run by the user on their own computer, and which is designed to process the user's personal information solely on that computer, does that processing make me a Data Controller for GDPR purposes?

No, the user is the controller and responsible to use your software (or not). You are responsible to provide all information which the user requires to make that decision.

| improve this answer | |
  • I agree that the software developer will not automatically be a controller, and that the location of processing (local/cloud) doesn't matter that much. But I still think that it depends on which processing occurs for what reasons. You are right that if the software only performs processing requested by the user, then the user is sole controller. But what the question seems to be about, and as discussed in my answer, the developer might be controller when causing processing for their own purposes. Thus, running code on the user's device is no automatic GDPR exemption and OP's quote is wrong. – amon Sep 23 at 19:44
0

It would depend on the context of the processing.

Looking at the comments to the initial question, a program such as "a fitness tracker, or a mapping program that records GPS locations" would seem to qualify as a "purely personal activity" given that only the user is involved and the processing happens solely on their computer/device.

Therefore, an Art. 2(2)(c) exemption appears to arise:

This Regulation does not apply to the processing of personal data ... by a natural person in the course of a purely personal or household activity

Such an exemption would mean that the GDPR does not apply at all.

| improve this answer | |
  • 1
    Of course an exemption can apply so that the user is not a data controller. However, per GDPR Recital 18, the GDPR would still apply “to controllers or processors which provide the means for processing data for such personal or household activities.” – amon Aug 1 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.