2

If I develop an Android App, the per-default setting is that the App's internal data, probably containing private data in terms of GDPR, is automatically backed up in Google Cloud (unless the phone has blocked this feature). Should I mention this in my privacy policy with a link to Google's policy? Or is this done already somewhere in the Google Play Store when I submit the App?

1
  • (I am not a lawyer and this is not legal advice) I just wanted to add that as reccomended along with b taking consent note you must also retain a record of all consents given along with time stamp and version and also store consent widthrwals. – compenthusiast Nov 20 '20 at 10:57
4

You are responsible for any processing of data that happens under your control – but are you the data controller in this scenario?

Since you have no meaningful influence over whether or not this backup happens on the operating system level, there could be a strong argument that you aren't a data controller for these backups. And if you aren't a data controller for that processing activity, you aren't responsible for compliance.

However, if you were to integrate directly with relevant Google APIs in order to facilitate backups that could make you a controller. Then, Google would either have to be your data processor (won't be the case here), or you would need a legal basis for sharing the user's data with Google. For example, you could ask for the user's consent before activating such features.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.