0

The GDPR does not apply to the processing of personal data that is "by a natural person in the course of a purely personal or household activity". I cannot find a description of "personal" that seems to apply here, this one would seem to include activity that an individual performed as part of their role in a company. The google answer would seem to include any activity that was not concerning my career or public life.

If I personally feel strongly about an issue, I may want to post multiple politicians' views on the issue on the web. This could include the politician's name and some sort of publicly available contact details such as twitter handle or official email address. If I were a company, GDPR would apply. However, as this is being done by a natural person, as part of an activity that has no commercial component, which could be described as "of or concerning my private life, relationships, and emotions rather than my career or public life", would the GDPR apply?

This question broaches this issue, but is focused on the personal data of the web site users. Assume there is no collection of user data, it is published as a static html page with no cookies or logging, and no adverts or donations. This question is more applicable, and it seems to say that "what matters is whether your activity is professional/commercial", which would apply in this case.

2

The GDPR is not intended to only regulate commercial processing of personal data, but is aiming for comprehensive data protection. This does also cover non-profit and political activity.

The exception for “purely personal or household activities” has to be interpreted somewhat narrowly. It does not apply to all personal activities, but to purely personal activities. The intention is clearly to exempt normal family and social life from GDPR compliance obligations. The GDPR explicitly mentions address books, social networking, and related online activities as examples of exempt activities.

The scenario you describe can be argued either way. It may or may not fall under the GDPR exception. However, I believe that this would have little consequence.

Personally, I think the exception will not apply if your web postings will be accessible to a wider circle than friends and family. Political activity such as participating in the shaping of public opinion is inherently public and outside of purely personal and household activities. So is making a website publicly accessible. Case law from the Lindqvist case confirms this:

47. That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.

In C-101/01, the ECJ had to decide whether a personal website that was created in the context of a church fell under data protection laws. This case related to the GDPR's predecessor, the Data Protection Directive. As an EU directive and not an EU regulation the legal situation was a bit different, but the old directive included the same exception as the GDPR. This answer contains a bit more background.

You have mentioned various steps that could be taken to limit collection or processing of personal data through such a website. However, this data minimization does not determine whether the website is limited to purely personal or household activities: If GDPR does not apply to the processing activity, then any processing of personal data would be fine. If GDPR does apply, then any collection must be lawful and comply with the various provisions.

What would it mean if you had to comply? You are proposing two somewhat distinct activities that have to be analyzed separately:

  • offering a website
  • listing personal data of a politician, such as name and their professional contact details

The case of offering a website has been discussed elsewhere in abundance. It is important to recognize that even a static website is unlikely to work without processing of personal data, since IP addresses are typically personal data. There are many steps that can be taken to minimize and avoid the collection and processing of data, but those are decisions taken by the data controller, who should still offer a privacy notice in line with the GDPR transparency principle and Art 13.

Publishing personal data about a politician is more interesting. Here, it is extremely important to note that the GDPR is not absolute. Instead, the GDPR rights and obligations MUST be balanced against other rights. Such other rights include in particular the right to freedom of expression which could be exhibited by political or journalistic activity. Any interpretation of GDPR that would make such activities impossible is likely incorrect. In fact, the GDPR explicitly asks member states to implement additional exemptions where necessary to safeguard freedom of expression (Art 85). The UK has implemented such exemptions. Where you publish a politician's professional contact details in the course of normal political or journalistic activities – but not e.g. to harass them – your EU/EEA/UK state will likely have an exemption for that.

Even if there wasn't an explicit exemption, your right to freedom of expression would almost certainly count as a legitimate interest that would be a legal basis for this processing under Art 6(1)(f).

6
  • I would be interested to see links to "The case of offering a website has been discussed elsewhere in abundance". I had assumed that hosting in a docker container with the apache logs piped to /dev/null on a site that claims "eu gdpr compliant". It is not like I can use the logs, I shall just turn it off and on again. Good answer generally. – Dave Apr 12 at 19:58
  • Lindqvist errs by pushing its own definition of purely personal. The term does not mean private or intimate. Were that the legislative intent, the GDPR could have used those more unequivocal terms or left it at "household activity". Instead, recital 18 suggests that intent is that the activity ought to be separate from "professional or commercial". Nor does being accessible to an indefinite vs foreseeably concrete number of people determines whether someone's activity qualifies as purely personal. Also the notion that IP addresses are "typically personal data" is speculative. – Iñaki Viggers Apr 13 at 9:18
  • @Dave Just because a site says it is GDPR compliant doesn't mean your use of this site will be GDPR-compliant as well: controller and processor roles are very different when it comes to compliance obligations, and many US services still mention the invalid Privacy Shield. – amon Apr 13 at 20:41
  • @IñakiViggers Saying that the ECJ – the highest EU court – erred in its interpretation is a bit unlikely. Especially since there later was strong lobbying effort to rephrase that exemption during drafting of the GDPR, yet the legislator stuck with the same phrasing that had been used as the basis for the Lindqvist decision. However, I would likely agree with your reasoning if it weren't for that background. Regarding IP addresses, the GDPR explicitly mentions “internet protocol addresses” as examples of personal data (Recital 30). See also law.stackexchange.com/a/61091 – amon Apr 13 at 20:49
  • @amon I asked this question and the one answer seems to say you are. If you cannot turn off logs you are not responsible for them. – Dave Apr 13 at 22:07
1

would the GDPR apply?

Your publication(s) would be GDPR compliant even if done by a company or someone with non-personal interests. That is because:

  • politicians' status renders their views on various issues a matter of public interest (see articles 6.1.e and 9.2.g);

  • the circumstances under which politicians state their views oftentimes constitute one or more affirmative actions from which consent can be inferred (article 6.1.a); and

  • politicians are identifiable anyway (example, the "sort of publically available contact details such as twitter handle or official email address"), which is an inevitable and/or desired effect of aspiring to make career in politics.

2
  • GDPR does not apply, yet you list potential Art 6 legal basis for processing under the GDPR? I think this answer uses very wrong arguments to arrive at the correct conclusion, that GDPR will not hinder OP's political activities beyond boilerplate compliance issues. – amon Apr 12 at 18:51
  • @amon Thanks for the feedback. I doubt the subtlety would have confused the OP or gotten him in trouble with the authorities, though. I think all of us grasp that the OP ultimately intends to avoid getting in trouble, and beyond that he wouldn't care that much about dialectics. The plural in "very wrong arguments" seems to be an exaggeration because said dialectic subtlety is the only specifics in your criticism. – Iñaki Viggers Apr 12 at 19:49
0

As described, the GDPR would not apply

If what you are planing would be a "published as a static html page with no cookies or logging, and no adverts or donations." then there would be no user personal information collected or processed. Reproducing the public statements of others, particularly of politicians and other public figures, within the limits allowed by copyright, is arguably not processing personal information at all, but insofar as it is, is justified under the lawful basis of Public interest, as Iñaki Viggers says in another answer.

Most of the issues of GDPR compliance only appear when user information is collected and processed. A web site that does neither has really no significant GDPR issues to deal with.

If such a site adds the possibility of permitting user comments, probably including user registration to make comments, then GDPR issues would be present, and this would probably be beyond the "purely personal or household activity" exemption.

1
  • Clearly publishing a politicians statement meets both the GDPR's definition of “personal data” (information relating to an identifiable person) and of “processing” (disclosure, dissemination, or otherwise making available). – amon Apr 12 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.