If I develop an Android App, the per-default setting is that the App's internal data, probably containing private data in terms of GDPR, is automatically backed up in Google Cloud (unless the phone has blocked this feature). Should I mention this in my privacy policy with a link to Google's policy? Or is this done already somewhere in the Google Play Store when I submit the App?
1 Answer
You are responsible for any processing of data that happens under your control – but are you the data controller in this scenario?
Since you have no meaningful influence over whether or not this backup happens on the operating system level, there could be a strong argument that you aren't a data controller for these backups. And if you aren't a data controller for that processing activity, you aren't responsible for compliance.
However, if you were to integrate directly with relevant Google APIs in order to facilitate backups that could make you a controller. Then, Google would either have to be your data processor (won't be the case here), or you would need a legal basis for sharing the user's data with Google. For example, you could ask for the user's consent before activating such features.
