1

I'm a private individual. I live in EU. I'd like to create a personal blog on blogger.com and put there Google AdSense advertisements. Do I have to state there also publicly my given name, surname, and my personal address where I live according to Art 13 GDPR?

Improve this question
1
  • You did not specify your country, but a post box might be acceptable instead of the address. Hiding your name is harder unless you form a company with someone else to take the blame.
    – o.m.
    Jan 7, 2022 at 18:01

1 Answer 1

Reset to default
3

Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity.

Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht.

Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially.

This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit?

However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.

Improve this answer
11
  • Thank you very much for your comprehensive answer. This is exactly what I needed. Just one more thing. Could you tell me, please, does all of this mean that if I use blogger.com (or medium.com for that matter) with no additional features/plugins like AdSense, i.e. essentially as a social media service, then this situation doesn't fall under the scope of GDPR at all? And I can keep my name and address private?
    – Mr. Question
    Jan 7, 2022 at 16:46
  • @Mr.Question Those are difficult questions. My guess is that those would still fall under the scope of the GDPR, that you would still be a data controller, and still have your obligations under Art 13. We know that ordinary social media users who only use the services for purely personal or household purposes are not data controllers. But we also know that people who run Facebook pages are data controllers. To me, using a platform like Blogspot or Medium seems more like running a FB page. GDPR also applies to non-commercial use, it only exempts purely personal and household purposes.
    – amon
    Jan 7, 2022 at 17:37
  • It seems to me that GDPR is a horribly bad law for active private individuals. And it could be fixed so easily. (1) A public registry could be introduced with names and addresses hidden, just plain numbers public. A court could order the name and address of a particular person to be revealed in case of GDPR infringement. (2) Countries could introduce a new special kind of anonymous, single-member, limited liability company with a virtual address and simple accounting that should cost no more than €50 (or €100) yearly. USA has such LLC in Delaware, New Mexico, Wyoming, and Nevada.
    – Mr. Question
    Jan 8, 2022 at 7:01
  • @Mr.Question I understand what you're saying, and it sucks for people like you and me, but I also understand why this EU law is the way it is. For me, the GDPR's requirements didn't change anything because of the German Impressumspflicht. Anonymous LLCs are a foreign concept in the EU because there's a huge opportunity for abuse.
    – amon
    Jan 8, 2022 at 13:03
  • According to § 18 Abs. 1 MStV (earlier § 55 Abs. 1 RStV), if a private person provides a publicly available password-protected website for his/her family and friends then that person doesn't have to make his/her name and address publicly known. But according to GDPR even in such circumstances, that person is required to do so because every website processes all incoming IP addresses which should be treated as PII, hence GDPR applies which also makes DPA necessary if the website is hosted by a third party. And GDPR takes precedence over MStV due to the fact that GDPR is an EU regulation. Right?
    – Mr. Question
    Jan 8, 2022 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .