2

If I, located outside the EU, use a server of a hosting company, which is located in the EU (as well as their servers), for a simple website without any data collection, forms, cookies and the like, there are still the IP addresses of the visitors which are being processed (at least stored), e.g. for security and/or legal reasons.

Now to my understanding I am the data controller of my website, and the hosting company is the data processor of the IP data of the visitors (they store it on their servers and might do some statistics, but I never touch this data). An EU paper on GDPR states the following (page 11, 12 of Guidelines 3/2018 on the territorial scope of the GDPR):

The separate question then arises of whether the processor is processing in the context of its establishment in the Union. If so, the processor will be subject to GDPR processor obligations under Article 3(1). However, this does not cause the non-EU controller to become subject to the GDPR controller obligations. That is to say, a “non-EU” controller (as described above) will not become subject to the GDPR simply because it chooses to use a processor in the Union.

Concerning the scenario above, is it sufficient to make sure that my hosting company in the EU fullfills GDPR, describe the setup (including a link to the hosting company's privacy policy) in my data policy, and point data requests to the hosting company?

1 Answer 1

3

It is in this context important to recall what a data controller and a data processor is. The data controller is the person or entity responsible for the data processing. They determine the purposes and means of this processing. A data processor merely performs data processing on the controller's behalf.

The processor must not process data for their own purposes, but can make low-level decisions about the means of processing. For example, a controller may specify the purpose of ensuring the security and integrity of the services, or the purpose of creating basic statistics. The processor might implement this in part through the means of keeping a logfile. Often, such purposes are agreed upon via a data processing agreement or the terms of service, leading to the legal fiction that the processor was instructed by the controller.

In your scenario, the controller is presumably not subject to the GDPR1, and therefore does not need a clear purpose or a legal basis for their processing activities. However, the EU-based data processor is bound by the GDPR, and can only process data as instructed by the controller. The processor has to comply with the GDPR with respect to how they carry out the processing activities, but the processing activities themselves don't have to be GDPR-compliant. Thus, it might be perfectly fine for an EU-based hosting provider to keep logfiles with IP addresses, even if those logfiles wouldn't be GDPR-compliant.

1: Whether GDPR applies to a non-EU data controller depends not on whether processing occurs in the EU, but on whether the controller is offering goods or services to people in the EU, or observing behaviour of people in the EU – see Art 3(2) GDPR.

The cited guidelines continue to enumerate which provisions of the GDPR would still apply to EU processors working on behalf of non-EU data controllers (pages 12–13). These requirements are about how the controller and processor work together and relate to internal compliance of the data processor, but they do not affect the processing activities themselves.

You mention that you would link to the hosting provider's privacy policy and direct data subject requests to the hoster. This misunderstands the role of the data processor. The data controller is the single point of contact for data subjects. The data processor is not a data controller in this scenario. They cannot issue a privacy policy for the controller's processing activities, and cannot respond to data subject requests. Their only relationship is with the data controller. If the hosting provider were to post a privacy policy for these processing activities, they would act like a controller (possibly a joint controller) and could bring the processing activities within scope of the GDPR – not what you are intending.

However, since GDPR does not apply to the processing activities in this scenario, the data subject rights in the GDPR do not apply. As far as GDPR is concerned, no privacy policy is needed and no data subject requests have to be answered. If the data processor receives such requests, their only obligation is to forward them to the controller, who can then handle them (possibly ignoring them).

9
  • 1
    One thing that is unclear is that how can it be said that the controller has instructed collection of IP addresses the controller has seems to have only instructed to host the website that's it ? Dec 26, 2020 at 14:27
  • 1
    @ask The data processor can make low-level decisions. A typical DPA includes instructions for the processor to ensure the security of the data processing activities, which the processor may interpret to require collection of IPs for some retention period. Often, the processor writes the DPA themselves to ensure they receive suitable “instructions” for all the stuff they need to do. Note also that many hosters don't collect IP addresses themselves, but merely provide a web server that the data controller can configure themselves. Of course, many servers log IP addresses in the default config.
    – amon
    Dec 26, 2020 at 14:34
  • (This is not legal advice and I am not a lawyer)Ok so basically all is in the dpa.If nothing such was mentioned there might then probably be some chance of joint controller ship.yes. Dec 26, 2020 at 14:39
  • @amon Thank you for the detailled answer, very helpful. Actaully, the hosting company we are dealing with has a dedicated privacy policy, claims to be GDPR compliant, and described in detail how they log IP data for leagal reasons and security (they delete it after a while).
    – UweD
    Dec 26, 2020 at 15:13
  • @amon Interesting point what you mention is "The data controller is the single point of contact for data subjects." I have often seen webpages referring to other company's policies for specific points of data handling, but I am aware that there are a lot of data policies out there which are wrong and/or full of mistakes.
    – UweD
    Dec 26, 2020 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .