GDPR, personal and political activity

Question

The GDPR does not apply to the processing of personal data that is "by a natural person in the course of a purely personal or household activity". I cannot find a description of "personal" that seems to apply here, this one would seem to include activity that an individual performed as part of their role in a company. The google answer would seem to include any activity that was not concerning my career or public life.

If I personally feel strongly about an issue, I may want to post multiple politicians' views on the issue on the web. This could include the politician's name and some sort of publicly available contact details such as twitter handle or official email address. If I were a company, GDPR would apply. However, as this is being done by a natural person, as part of an activity that has no commercial component, which could be described as "of or concerning my private life, relationships, and emotions rather than my career or public life", would the GDPR apply?

This question broaches this issue, but is focused on the personal data of the web site users. Assume there is no collection of user data, it is published as a static html page with no cookies or logging, and no adverts or donations. This question is more applicable, and it seems to say that "what matters is whether your activity is professional/commercial", which would apply in this case.

Answer 1

The GDPR is not intended to only regulate commercial processing of personal data, but is aiming for comprehensive data protection. This does also cover non-profit and political activity.

The exception for “purely personal or household activities” has to be interpreted somewhat narrowly. It does not apply to all personal activities, but to purely personal activities. The intention is clearly to exempt normal family and social life from GDPR compliance obligations. The GDPR explicitly mentions address books, social networking, and related online activities as examples of exempt activities.

The scenario you describe can be argued either way. It may or may not fall under the GDPR exception. However, I believe that this would have little consequence.

Personally, I think the exception will not apply if your web postings will be accessible to a wider circle than friends and family. Political activity such as participating in the shaping of public opinion is inherently public and outside of purely personal and household activities. So is making a website publicly accessible. Case law from the Lindqvist case confirms this:

47. That exception must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.

^{In C-101/01, the ECJ had to decide whether a personal website that was created in the context of a church fell under data protection laws. This case related to the GDPR's predecessor, the Data Protection Directive. As an EU directive and not an EU regulation the legal situation was a bit different, but the old directive included the same exception as the GDPR. This answer contains a bit more background.}

You have mentioned various steps that could be taken to limit collection or processing of personal data through such a website. However, this data minimization does not determine whether the website is limited to purely personal or household activities: If GDPR does not apply to the processing activity, then any processing of personal data would be fine. If GDPR does apply, then any collection must be lawful and comply with the various provisions.

What would it mean if you had to comply? You are proposing two somewhat distinct activities that have to be analyzed separately:

• offering a website
• listing personal data of a politician, such as name and their professional contact details

The case of offering a website has been discussed elsewhere in abundance. It is important to recognize that even a static website is unlikely to work without processing of personal data, since IP addresses are typically personal data. There are many steps that can be taken to minimize and avoid the collection and processing of data, but those are decisions taken by the data controller, who should still offer a privacy notice in line with the GDPR transparency principle and Art 13.

Publishing personal data about a politician is more interesting. Here, it is extremely important to note that the GDPR is not absolute. Instead, the GDPR rights and obligations MUST be balanced against other rights. Such other rights include in particular the right to freedom of expression which could be exhibited by political or journalistic activity. Any interpretation of GDPR that would make such activities impossible is likely incorrect. In fact, the GDPR explicitly asks member states to implement additional exemptions where necessary to safeguard freedom of expression (Art 85). The UK has implemented such exemptions. Where you publish a politician's professional contact details in the course of normal political or journalistic activities – but not e.g. to harass them – your EU/EEA/UK state will likely have an exemption for that.

Even if there wasn't an explicit exemption, your right to freedom of expression would almost certainly count as a legitimate interest that would be a legal basis for this processing under Art 6(1)(f).

Answer 2

would the GDPR apply?

Your publication(s) would be GDPR compliant even if done by a company or someone with non-personal interests. That is because:

• politicians' status renders their views on various issues a matter of public interest (see articles 6.1.e and 9.2.g);

• the circumstances under which politicians state their views oftentimes constitute one or more affirmative actions from which consent can be inferred (article 6.1.a); and

• politicians are identifiable anyway (example, the "sort of publically available contact details such as twitter handle or official email address"), which is an inevitable and/or desired effect of aspiring to make career in politics.

Answer 3

As described, the GDPR would not apply

If what you are planing would be a "published as a static html page with no cookies or logging, and no adverts or donations." then there would be no user personal information collected or processed. Reproducing the public statements of others, particularly of politicians and other public figures, within the limits allowed by copyright, is arguably not processing personal information at all, but insofar as it is, is justified under the lawful basis of Public interest, as Iñaki Viggers says in another answer.

Most of the issues of GDPR compliance only appear when user information is collected and processed. A web site that does neither has really no significant GDPR issues to deal with.

If such a site adds the possibility of permitting user comments, probably including user registration to make comments, then GDPR issues would be present, and this would probably be beyond the "purely personal or household activity" exemption.