0

Say I have a mobile app that uses Firebase Crashlytics and Google Maps without requiring a Google Sign-In, I assume that I have to ask for consent as I'm not sure they fall under legitimate interest, since there are possible alternatives.

As far as I know I have to give a possibility to opt-out, which I can provide by giving the user the possibility to delete his/her account on my backend and delete all associated data that I collected, but I can't delete any logs made by Crashlytics or Maps, because they are not tied to an account, but they still collect personal data, since the IP address counts as such.

Do I have to provide an opt-out of log data on third party data processors when I have received a consent before-hand? And if so, how would I approach this problem in the right manner?

1 Answer 1

2

This is going to depend on whether those services act as independent controllers, or as your data processors.

If they are separate controllers, then you need a legal basis for sharing your user's personal data with them, which happens e.g. by loading content from their services. This legal basis will typically be consent, and will typically be implemented in a click-to-load fashion, where the functionality initially has a placeholder that asks for consent, and is later replaced with the embedded content if consent is given. You are not responsible for the independent controller's privacy practices, though. You are not the data controller for the services' logfiles.

If they are your data processors, then things are very different. You are not sharing your users personal data with another service, you are processing personal data under your authority, and have merely outsourced some aspects of these activities. If a data processor maintains logfiles, these are your logfiles that they just maintain on your behalf. You would be fully responsible for them, including, if appropriate, by facilitating the exercise of data subject rights like access or erasure.

Since you cannot delegate responsibility for compliance to your data processors, you should only engage data processors where you are confident that using their services allows you to be fully GDPR-compliant. Before integrating their services, you might evaluate what data will actually be processed, whether this is necessary for your purposes, how you can configure the data processing activities, and how you can fulfil data subject rights with regards to these processing activities. For example, a service provider might offer a data protection dashboard where you can export or delete user data, if that service provider wants to make it easy to use their services in a GDPR-compliant manner.

Even if engaging the service as a data processor, you will need a legal basis for the actual processing activity. This might be consent (opt-in), or a different legal basis like a legitimate interest, in which case an opt-out may be required. When consent is revoked or a legitimate interest is objected to, past processing activities remain lawful. Whether past data will have to be deleted depends on context.

Whether or not an "account" was created on your backend is a red herring. If you can identify the data subject's information on the backend, they can exercise their data subject rights. This is possible without an account e.g. if pseudonymous client IDs are used. However, you are not required to keep identifying data just for GDPR purposes (see Art 11). If it is not possible for you to locate the data subject's records, then the data subject rights like access and erasure don't apply.

Personal tip for Google services: Google offers a wide variety of services under very different terms. You will have to investigate those services on a case by case basis. For some such as Maps, Google will be the data controller. For other such as Crashlytics, Google will act as a processor. But as of 2023, Google does not guarantee for most of its services that personal data will only be processed in the EU or in countries with an adequate level of data protection. This can make it extremely tricky (or outright impossible) to use their services in a GDPR-compliant manner. Sometimes the use of such possibly-noncompliant services can still be a valid business decision, but the safer approach would be to avoid Google services whenever possible. Crashlytics is closely related to the Analytics product, for which some European data protection authorities have explicitly stated that it cannot be used in a compliant manner.

5
  • In essence, asking for proper consent before introducing a third-party will most likely require it to be a data controller, but it frees me of any responsibility of log files as my legal document that asks for consent is solid. I can choose to introduce a data processor on my behalf if it is GDPR-compliant and signed a DPA. Your response fully answers my question, because now I know that I don't have to care about the collected data of another data controller if consent was given by the user. Since I initialize firebase and maps only after consent, I'm good to go. Apr 11, 2023 at 20:31
  • It's also helpful to understand that I cannot simply turn any service that is GDPR-compliant into a data processor, but in fact need a good reason to do so, i.e. legitimate interest. It's also valuable to understand when revoking must be possible. Right now, the user cannot revoke before account creation, because all that is picked up by my service is the IP address on my network, which falls under legitimate interest (cybercrime prevention), and it will be deleted on the 2nd log rotation, so possible erasure shouldn't apply on guests. Apr 11, 2023 at 20:40
  • 1
    @MartinBraun I think you don't quite understand the "data controller" concept yet. Whether someone is a controller or processor is an objective question, and doesn't depend on your choice of legal basis. Controller is whoever determines the purposes and means of processing. Google is the controller for Maps because they decide how Maps user data is used. Google is not the controller for some or all Firebase features because Google just offers a service, and you as the controller decide how and why to use that service.
    – amon
    Apr 12, 2023 at 11:53
  • I'm probably thinking too black and white. Can I use a "data processor" as "data controller" in my service when I simply ask for proper consent or will it just be a "data processor" that I don't have legitimate interest for? In my head I tied "data processors" to services that could be used without consent with legitimate interest that I can use as "data controllers" with proper consent, if I don't have a legitimate interest in use them. If this is a purely objective definition, would I need DPA for using a "data processor" without legitimate interest, but with proper consent? I think not. Apr 12, 2023 at 22:09
  • @MartinBraun I think it would be better to start with the basics: (1) Why? What is the purpose of processing? (2) What legal basis covers this processing activity? (3) How? What is the minimum data necessary to achieve the purpose? For example – why: show brand video on website, how: host video on server under our control, legal basis: 6(1)(b) necessity. Doesn't matter here if we run the server, or if it is provided by a processor on our behalf. Alternative example – purpose: embed YouTube video, legal basis: consent because YT is outside our control.
    – amon
    Apr 16, 2023 at 10:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .