4

To my knowledge IP addresses are considered personal data under the GDPR and thus may only be processed under one of several conditions (one being user consent). There has also been a verdict in a German court according to which embedding Google Fonts (loaded from Google servers) requires such consent, because the IP address is shared with Google. So website operators can either ask for consent or serve the fonts from their own server instead.

But, what if my entire site is hosted at Google? Obviously Google receives the visitors' IP addresses starting with the very first HTTP request and I get no chance to ask them for permission BEFORE that happens. There are plenty of hosting options inside the EU. Let us assume that my site is static and could be hosted on any one of them, so I can make no argument for choosing Google specifically.

  • Am I even allowed to use Google for hosting my site?
  • Does it make a difference whether I inform the visitor (after the processing of their IP has already happened)?
  • IF it is OK, can I then use Google Fonts without consent, because Google has already seen the visitor's IP anyway?

Side note: These seem like really weird questions to ask, but after following some GDPR debates about Google Fonts and even basic things like HTTPd access logs, nothing seems quite certain anymore.

Improve this question

1 Answer 1

Reset to default
2

When you use other services, the question is whether that service acts as an independent data controller, or as a data processor who only uses the data on your behalf. When engaging a data processor they must be legally bound to only use the data on your behalf, for example with a contract / data processing agreement (DPA). See Art 28 GDPR.

Data processor status is attractive because processors are seen as an extension of the controller. In contrast, when sharing data with other controllers you would need a separate legal basis to authorize this sharing.

Google offers tons of different services, so this question needs to be considered on a case by case basis. For Google Cloud services or Google Workplace, Google generally acts as a data processor. For other services, Google acts as a controller. Notably, Google Fonts does not offer a DPA so that you cannot claim they're acting as a processor in that context, regardless of what other Google services you use.

An equally important problem when using Google services is the data transfer problem. Google is controlled from the US, but the US do not offer an adequate level of data protection (see the Schrems II judgement). Comparatively few Google services allow you to select where the servers are located, as to prevent transfers of personal data to countries where privacy cannot be guaranteed. For example, this is why Google Analytics (GA) is problematic. Google acts as a data processor for basic GA features but makes no promises about the location of servers. Thus, using GA implies a (probably) illegal transfer of personal data to the US.

Improve this answer
6
  • Do I get it right to assume that a data processor need to be GDPR-compliant? And if the data processor signed my DPA, it is obliged to NOT log any personal data in GDPR-compliance and I can prove it with such document in case of a sue-case, right? I obviously cannot inform the user before he/she accesses the service when the service is hosting a website. Do I still need to inform the user about it in the privacy policy? For instance, do I have to inform my user about storing personal data on my EC2 instance and S3 data storage which is both located in the EU and is GDPR-compliant?
    – Martin Braun
    Commented Apr 9, 2023 at 23:35
  • To be clear, access logs have things like an IP address, but also personal addresses or phone numbers are personal. Things like these will be hosted on S3. Since Amazon will be a data processor that is GDPR-compliant and signs my DPA, it should be safe to not inform the user that his/her data is stored in S3, as long as the data remains in the EU. This is at least my conclusion when reading your answer. I was always under the impression that I have to inform the user about storing personal data no matter what, but the distinction between data controller and data processor actually makes sense.
    – Martin Braun
    Commented Apr 9, 2023 at 23:57
  • 1
    @MartinBraun Compliance responsibilities for Controllers and Processors are very different. The main responsibility of the Processor is to follow Controller's instructions and comply with the DPA contract. One of the Controller's responsibilities is providing transparent information to data subjects per Art 13 GDPR. Such privacy notices must also disclose all “recipients” of personal data, which also includes Processors (Art 13(1)(e)). So you should disclose AWS as a Processor. There is a separate responsibility to inform about international data transfers, if any occur (Art 13(1)(f)).
    – amon
    Commented Apr 10, 2023 at 8:11
  • So in other words, I have to inform my users about the data processors who comply with the GDPR and signed my DPA in my privacy policy, but I don't need to ask for consent before-hand? In contrast, to give/store personal data to/on any data controller (incl. me, but also others like in the case of Google Fonts) I have to ask for consent beforehand. Right?
    – Martin Braun
    Commented Apr 10, 2023 at 13:08
  • 1
    @MartinBraun You need a legal basis for all processing activities, regardless of whether you outsource these to a data processor. This may be consent, but doesn't have to be – see Art 6(1) GDPR for options. Normally, personal data is processed because this is necessary to fulfil a contract with the data subject. Some processing may be necessary for a legitimate interest, in which case it may be necessary to offer an opt-out. Consent is mostly appropriate for processing activities that are not necessary, or when legally mandated (e.g. sensitive data per Art 9, or non-necessary cookies).
    – amon
    Commented Apr 10, 2023 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .