How to avoid having problem with data protection regulations (GDPR)?

Question

I would like to make an online platform, where the users can upload videos or link YouTube videos. Right now, I don't want to earn anything through this website (maybe in a couple of years, and by advertising, but absolutely not now). I use the YouTube Plugin to embed the videos in my website. As the users can create accounts on my website, I need to include the "privacy policies" in my page.

I asked a lawyer to write this text for me and he did that. However, he warned me that using the YouTube Plugin may be problematic (even when I use YouTube in privacy enhanced mode) and is not necessarily in accordance with the data protecion rules in EU (I live in Germany).

As using this plugin is the heart of my website, I can't avoid using the plug in. Now, I would like to know how I can solve the problem.

To whom exactly do the data protection rules (DSGVO/GDPR) apply? My website would be ".com" (and not ".de", I don't register any company for that in Germany and the website is in English and not necessarily for German. Why should the regulation apply to me? Just because I am living in Germany?

How can I avoid this problem? Should/Can I register a company in the USA? Isn't there any better way?!

Thanks in advance,

Answer 1

Yes GDPR applies, no you can't make the law not apply to you. Much like taxes, data protection is not optional. Even if you were to create a foreign company, you'd be conducting business from Germany so all processing activities would be in the “context” of your German establishment and therefore fully subject to the GDPR.

But complying with GDPR might not be a big problem for you.

When embedding content from third parties, you need a “legal basis” why you're allowed to share personal data with that third party. For example, simply embedding a YouTube video necessarily shares personal data such as your user's IP addresses with YouTube.

The solution is to not load the embedded video until the user has given their consent, which is a legal basis per Art 6(1)(a) GDPR. Until then, show a placeholder for the video. This has been the standard approach for German websites for about a decade, and the importance of not embedding third party content was emphasized by the 2019 Fashion ID case at the CJEU and in 2022 by a case at the LG München relating to the use of Google Fonts. I discussed the Fashion ID case in this other answer where I also link to a an article by the Verbraucherzentrale that shows an example of such a consent placeholder.

You should discuss the specific text on the placeholder with your lawyer. In line with a “layered” approach to transparency, the placeholder itself might only provide an essential summary and provide a link to more detailed information, e.g. as part of your privacy policy. For a discussion of which information is necessary in order to obtain valid consent, read the EDPB guidelines on consent, especially section 3.3.1 (paragraph 64).

Once the user has given their consent to load YouTube videos, you can remember that consent e.g. with a cookie so that you don't have to constantly ask them.

Answer 2

The answer is yes, the regulation applies to you because you are established in the EU (Germany is part of the EU, and a significant part of why the GDPR was established in the first place, so Germany as such does not change the situation). - See art. 3, p 1

Even if you were established in the US, that wouldn't help as long as you process the data of Europeans. - See art. 3, p 2

Why would you want to go the length of establishing a US base just to meet a basic requirement for your website?

Now the problem is that the YouTube videos track users across the web, even in privacy enhanced mode (I think that's without cookies, if I remember well). The solution for that is to look around for CMPs, consent management platforms. With such a solution, you can get the users' informed consent for embedding content from YouTube.

I hope this helps!

Answer 3

Don’t operate in the EU or UK

The GDPR applies to the processing of “personal data of data subjects”, controllers and processors who are in the EU, but also to “processing activities” related to: (1) offering goods or services; or (2) monitoring data subject behavior that takes places in the EU. See GDPR Article 3(2).

If any of the users on whom you collect data are (or might be) in the EU (plus UK), you cannot escape the GDPR.