GDPR & Privacy Policy for a personal website where the only potential personal data is IP logs

Question

I'm based in the UK, and I am building a personal website (basically an online resume/portfolio) which I have ensured does not collect any personal information (there are no forms, cookies etc.). I do not currently run a company/business.

The only form of potential data collection is that the web host I use has logging of IP addresses which logs when a webpage or file is requested. These logs are temporary (a max of ~2000 log entries are recorded at any given time, and automatically expire after a week).

The web host which manages the service for me hosting my website is owned by a US company, but when choosing to set up the web app, I have specifically chosen servers in Europe. The host has mentioned that the logs for the servers may route through US servers, but they are using the EU - US Privacy Shield framework set forth by the US Department of Commerce and the EU.

On my contact page, there is a button which allows visitors to contact me using email (a mailto:// link). Only if the user wants to contact me, do they have to click the button, which will open up their email application and they can then send me an email.

I'm somewhat confused by what needs to be included in a privacy policy/notice. Do I simply need to state that IP addresses are logged but are deleted after a week? Not sure if there is anything else that needs to be included, specifically for GDPR. As the user is choosing to send me an email, do I need to state anything about the email communication between us both)?

Answer 1

When you collect or process personal data, you must provide information to data subjects. The required information is listed in Art 13 GDPR, though most privacy notice also include the items from Art 14 GDPR (if there are third party data sources) and Art 15 GDPR (which simplifies responses to data subject access requests). The ICO has provided detailed explanation and a checklist here. The list seems fairly long, but for such a simple site it will mostly be boilerplate.

Note that if you engage third parties to process personal data on your behalf, you need to sign a data processing agreement with them. This may be a separate document or may be part of the normal terms of service, but must fulfil the requirements in Art 28 GDPR. Importantly, the data processor must only use the data as instructed by you, and not for their own purposes.

That the logs are routed through US servers is very unfortunate since this is an international transfer of personal data. Such transfers are allowed, provided that there are suitable safeguards. The Privacy Shield was considered a safeguard, but in 2020 was ruled to be invalid due to concerns about mass surveillance and the rule of law in the US. Any notices about Privacy Shield in your hoster's documentation are of purely historical significance. Transfers can continue if there's another safeguard, such as Standard Contractual Clauses. However, SCCs are ineffective if the recipient can't legally comply with them. If it was impossible for an US-based company to provide for an adequate level of data protection under Privacy Shield, they likely won't be legally able to sign SCCs as well. This can be fixed by supplemental security measures such as end-to-end encryption, but that's not really feasible in a cloud context.

All of this is a complicated way of saying: you can either find another hoster that doesn't transfer personal data into the US, or adopt an interpretation that the Schrems II case doesn't apply to your circumstances. My personal non-lawyer opinion is that while the first solution is obviously the correct one, a risk analysis could indicate that a purely static site (that does not process any personal data other than the necessary connection data) is of such low risk that the transfers may continue for the meanwhile. But this is a bet on the ICO's goodwill.

The privacy notice on your website must first deal with processing activities relating to the website. It's OK if you don't explain how you'll process emails. For a portfolio site, there might be an argument that email communication is out of scope for the GDPR, since nearly all communication would be of purely personal nature.