GDPR concerning IP logging by hosting company inside EU

Question

If I, located outside the EU, use a server of a hosting company, which is located in the EU (as well as their servers), for a simple website without any data collection, forms, cookies and the like, there are still the IP addresses of the visitors which are being processed (at least stored), e.g. for security and/or legal reasons.

Now to my understanding I am the data controller of my website, and the hosting company is the data processor of the IP data of the visitors (they store it on their servers and might do some statistics, but I never touch this data). An EU paper on GDPR states the following (page 11, 12 of Guidelines 3/2018 on the territorial scope of the GDPR):

The separate question then arises of whether the processor is processing in the context of its establishment in the Union. If so, the processor will be subject to GDPR processor obligations under Article 3(1). However, this does not cause the non-EU controller to become subject to the GDPR controller obligations. That is to say, a “non-EU” controller (as described above) will not become subject to the GDPR simply because it chooses to use a processor in the Union.

Concerning the scenario above, is it sufficient to make sure that my hosting company in the EU fullfills GDPR, describe the setup (including a link to the hosting company's privacy policy) in my data policy, and point data requests to the hosting company?

Answer 1

It is in this context important to recall what a data controller and a data processor is. The data controller is the person or entity responsible for the data processing. They determine the purposes and means of this processing. A data processor merely performs data processing on the controller's behalf.

The processor must not process data for their own purposes, but can make low-level decisions about the means of processing. For example, a controller may specify the purpose of ensuring the security and integrity of the services, or the purpose of creating basic statistics. The processor might implement this in part through the means of keeping a logfile. Often, such purposes are agreed upon via a data processing agreement or the terms of service, leading to the legal fiction that the processor was instructed by the controller.

In your scenario, the controller is presumably not subject to the GDPR¹, and therefore does not need a clear purpose or a legal basis for their processing activities. However, the EU-based data processor is bound by the GDPR, and can only process data as instructed by the controller. The processor has to comply with the GDPR with respect to how they carry out the processing activities, but the processing activities themselves don't have to be GDPR-compliant. Thus, it might be perfectly fine for an EU-based hosting provider to keep logfiles with IP addresses, even if those logfiles wouldn't be GDPR-compliant.

^{1: Whether GDPR applies to a non-EU data controller depends not on whether processing occurs in the EU, but on whether the controller is offering goods or services to people in the EU, or observing behaviour of people in the EU – see Art 3(2) GDPR.}

The cited guidelines continue to enumerate which provisions of the GDPR would still apply to EU processors working on behalf of non-EU data controllers (pages 12–13). These requirements are about how the controller and processor work together and relate to internal compliance of the data processor, but they do not affect the processing activities themselves.

You mention that you would link to the hosting provider's privacy policy and direct data subject requests to the hoster. This misunderstands the role of the data processor. The data controller is the single point of contact for data subjects. The data processor is not a data controller in this scenario. They cannot issue a privacy policy for the controller's processing activities, and cannot respond to data subject requests. Their only relationship is with the data controller. If the hosting provider were to post a privacy policy for these processing activities, they would act like a controller (possibly a joint controller) and could bring the processing activities within scope of the GDPR – not what you are intending.

However, since GDPR does not apply to the processing activities in this scenario, the data subject rights in the GDPR do not apply. As far as GDPR is concerned, no privacy policy is needed and no data subject requests have to be answered. If the data processor receives such requests, their only obligation is to forward them to the controller, who can then handle them (possibly ignoring them).