10

TL;DR: my university says my app is illegal

Since our university doesn't have a mobile app to check our schedules, I created one that does the following:

  1. Opens an embedded web browser (in app) and goes to the login page
  2. Navigates to the time table URL
  3. Gets the iCal URL html element

Am I breaking any laws in the EU (like GDPR?)

Step 1: I don't think it's illegal to create an embedded browser in your app, since the chrome iOS app is doing the same and is also able to access our login portal. We don't store or process data in this step.

Step 2: Automatically calling a URL in an embedded browser should be legal?

Step 3: One could say the iCal link is personal data and protected via GDPR.

The format of the iCal link:

https://myuniversity.com/randomgeneratedID

So no personal data here.

I don't think the contents of the iCal file are personal data either:
Our university posts all the schedules publicly on their website (without a login).
The file contains a sequence of specific lessons, but I don't think a sequence of specific lessons would be able to identify a single person, since it only contains a lesson title, date and hour.

Who's in the right here?

Thanks!

18
  • 6
    "I don't think a sequence of specific lessons would be able to identify a single person" - depends on how your University is organised. Under GDPR data can be PII if it can be used to identify you, even if correlation with other data sources is required. So, if I know that you are taking courses in Electromagnetism, Mechanics, Astrophysics, French, Electronics and Rugby that may be enough to uniquely identify you (i.e. there is only 1 student studying those specific options). The randomly generated ID can also be PII if it can be linked back to an individual. Commented Sep 30, 2023 at 11:11
  • 1
    I don't think a sequence of specific lessons would be able to identify a single person It could, if you are able to combine it with other known information. For example if you happen to know that only one person is currently signed up for a given lesson, this link would allow you to connect the random id to that person. Commented Sep 30, 2023 at 18:56
  • 1
    @NeilTarrant PII is a US concept, nowhere to be found in the GDPR. Indeed, you are pointing to one of the differences between personal data and PII.
    – Relaxed
    Commented Oct 1, 2023 at 7:33
  • 3
    As far as I read, looks like it's the OP who assumed that it's related to GDPR in the original revision, while then clarifying in a later revision that scraping was not allowed by the university. The latter is usually the case, for many reasons, just like Stack Exchange generally disallows (read: make it harder to) scraping the site directly instead of using their API.
    – Andrew T.
    Commented Oct 1, 2023 at 11:01
  • 4
    Is the law actually your problem here? Even if the university claims your app is illegal, surely it's much easier for them to expel you than to sue you, right? And surely they don't need legal cause to expel you? And surely you would prefer not to be expelled. Commented Oct 1, 2023 at 20:27

5 Answers 5

19

Reading public data on the internet is not illegal. They published it for exactly that reason. So people would take an app and show them those fancy bytes in a way a human can understand them.

Even if they put up a webpage saying "Joe Dalton, the heterosexual, male, christian teacher will teach your class on Business Ethics on Friday at 11:00", while that is way too much personal information to put on a webpage, that would be their problem. Not yours. You didn't put it there. You reading it, through whatever means, is not illegal.

Now, it gets a little more complicated if you do more than just reading this information for your personal gain. If for example you saved it in your app, and your app is available to the public and not just your fun project on your own phone, it would be subject to GDPR rules. If you use that saved information to publish this information again, through your app, maybe even to people who have no access to the website, that would defintely be a problem.

If you only gained access to this website by agreeing to terms (for example having a login that came with a contract) then there might be something in those terms not allowing you to save data.

If your app enables a student to read information that they would have access to anyway, without saving it to some kind of database, you basically wrote an alternative, university-schedule-only web browser. You don't do anything Chrome or Edge don't do. That is not illegal.

I can't see why it would be illegal. However, as always, there are countless details that might swing this to either side. If in doubt, get a lawyer. As a first step, ask the university why they think it's illegal. Maybe they know something we don't, or maybe they see it from an angle you have not thought of (and therefore not asked about here).

4
  • Thanks! We get the iCal link and save it to the users profile on our server, so it can download the calendar on different devices (when signed in). I agree on your point that we're basically providing a automatic ical link finder, information that the user would get anyway (by manually clicking a few buttons). I think the uni's biggest concern is that they find it a big security risk that an app with an embedded browser can access their site.
    – Tom Vk
    Commented Oct 1, 2023 at 9:17
  • After your update: both their reasons are complete BS as written. However, they may still be right about the whole thing even though they obviously cannot articulate themselves in a way that would make sense legally. You should contact a lawyer before you proceed to make sure you cover all bases. After all, they might still get you on formalities, like using their name or logo without permission, or something like that. So go get a professional to look at it.
    – nvoigt
    Commented Oct 2, 2023 at 6:03
  • I still cannot say whether an iCal link is personal information. The pure information "Business Ethics 101 is in Room 76 at 11:00" is certainly not. "by Mrs. Miller, your 34 year old, homosexual, christian teacher with tax id #243875" certainly is. You could probably circumwent that, by just omitting the second part from your database, even if it is contained in the iCal link.
    – nvoigt
    Commented Oct 2, 2023 at 6:06
  • Your app still has to conform to the GDPR if you save student details in their accounts. Lets say Joe Random is a student and uses your app, and he has a profile in your app with their personal data, or you save their personal iCal ids. But that is between you and your users, not something the university has any say in.
    – nvoigt
    Commented Oct 2, 2023 at 6:12
3

Update on university pov:

  1. They say opening their website in an embedded browser is not allowed
  2. They say scraping is not allowed

The problem is:

  1. Opens an embedded web browser (in app) and goes to the login page

If there is a login page, this means that students must have some kind of account.

When creating the account, students must accept the conditions of the web page - and once they accepted the conditions, they have to comply with them.

If the conditions that you have to accept when creating the account say that you are only allowed to access the account using a "normal web browser" (just as an example), you are not allowed to access that account using a smartphone app.

If this is really the problem here, this has nothing to do with laws (like GDPR) but only with the conditions that you accept when creating the account.

3
  • 3
    That doesn't make the app illegal. That would be a matter between the user and university.
    – vidarlo
    Commented Oct 2, 2023 at 11:26
  • 1
    Fist of all, not all ToS/EULA/whatever are actually enforceable or valid. Second, thats a problem between the user of the app and the university. The app itself is not "illegal", using it might be against the universities ToS. But for something to be illegal, there must be a law that says so, (Nulla poena sine lege).
    – Polygnome
    Commented Oct 2, 2023 at 19:28
  • @vidarlo The question is: What does the sentence "the app is illegal" mean? Does it mean: "Writing the app was illegal", "distributing the app is illegal", "using the app is illegal", "advertizing the app is illegal", "owning a copy of the app is illegal" ... ? The university and the OP may have a different understanding about the term "to be illegal" in this point. Commented Oct 3, 2023 at 8:25
0

'randomgeneratedID' is personal identification

If randomgeneratedID is unique to each student. Which it surely is.

2
  • 13
    While this is an important correction to a mistake in the question, it isn't really an answer.
    – wizzwizz4
    Commented Sep 30, 2023 at 17:45
  • 1
    It's definitely not an answer, and needs to distinguish between "randomgeneratedID" being a public user identifier vs its being some sort of cryptographic key- which the student might or might not be obliged to keep confidential. Commented Sep 30, 2023 at 23:03
0

I am not sure I understand exactly who uses your app in what circumstances but note that processing is lawful under article 6 if it

is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

If I download an app to get updates on my personal schedule and this apps downloads my schedule, it's definitely OK even if said schedule happens to be personal data. There is a widespread misconception that the GDPR requires consent for everything but it is not true. Consent also seems totally unproblematic in your case as you're not trying to “bundle” consent for different things, the app only does exactly what its users actually expect from it.

The real problems start when app developers add all the usual stuff that businesses use these days to develop and monetise free apps (including ads, consolidating and selling the data, analytics and various libraries of dubious provenance).

Note however that your obligations under the GDPR do not stop with lawfulness. You need to make sure you only process the data you required, properly secure it, offer ways to rectify or delete it. All this is especially relevant if, e.g., your app requires creating an account and caches the data on a server.

But, but, but… if you're not uploading the data to some server, it's not even obvious to me that you are a data processor, let alone a data controller, the person who installed your app is! And the GDPR definitely doesn't make it illegal for them to process their own personal data.

There could also be other issues with scrapping beside personal data / GDPR.

2
  • After our (client side) scraper has run, we show the user a dialog : "we've found an iCal link". When the user clicks accept, the iCal link gets send to our server. When denied, no data left the device.
    – Tom Vk
    Commented Oct 1, 2023 at 9:20
  • @TomVk Then it would seem that you have some obligations regarding what you do with the data after that (Are you taking steps to keep it secure? Can users request deletion? etc.) And like I said, scrapping could theoretically raise other questions, e.g. intellectual property, as do a lot of tracking, monetisation, or marketing libraries. But the notion that the university could leverage the GDPR to regulate how their data are used or your argument that these calendars are not, in fact, personal data sound like red herrings to me.
    – Relaxed
    Commented Oct 1, 2023 at 10:27
-2

Even without being a GDPR expert by any stretch, I'd immediately assume that what you're doing at least violates GDPR, personally, simply by gaining direct access to individual student accounts within the University's privileged systems, and processing pages that one would assume have protected personal data.

From your interaction flow (particularly the description of scraping after sending the user to a login page), it sounds like you are having the student log into their account, via the app's embedded web view, NOT via native web authentication services or the external web browser. This gives your application full access to the student's account, as if the application is the student.

This is very different from a token based flow through an external browser or system API where your application could never intercept login information (MitM and other attacks/sniffing/spoofing are possible via embedded web views, etc) or just generally make interactions as if it is the student (presumably, from your flow, how your app is getting the ical uri in the first place?), because the login would occur via a handoff to an external web browser and a returned token.

From your perspective, "what you're doing" with that access matters, and equally you see your "processing" as limited to a single URI. From the University's perspective, "what you SAY you're doing" with that access is immaterial to the fact that you're getting it in the first place. My rather limited (US based, simply basic compliance focused) understanding of GDPR would be that the University is 100% correct if they are taking that stance, because at minimum your actions can be seen as causing a breach of their GDPR duties if they take no action to stop you.

And finally, from a GDPR perspective, my understanding would be that "processing" would constitute everything on the pages your application downloads in order to locate the related URI, even if your application isn't, from your stance, "doing" anything with the rest of what it downloaded. Your app necessarily downloads the entire page(s), this constitutes a form of processing under GDPR:

Chapter 1 Art 4 Section 2

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Even if you "do" nothing with the rest of the page contents, downloading a page (because that's necessarily what happens in order to "more directly" process any part of a page) with GDPR protected personal data is a "retrieval" under GDPR, and thus is definitionally "processing" under GDPR. (I think for this we can skip getting into questions of "storage" in relation to a web view downloading a page and potentially caching what's on it in on device storage, etc, but it's worth keeping in mind when considering legal compliance aspects: any degree of "touching" certain data can constitute legal liabilities and require knowing for sure you have fully scrubbed it)

"my university says my app is illegal"

So, what has your university actually accused you of? You've tagged your question with GDPR, but it's unclear if the university has actually said "your application violates GDPR" and why, or if they've said something else.

Beyond "just" presumably processing GDPR protected data, it's not what you're claiming to be doing or claiming to not be doing, it's what you could do because of what you do, actually, do

Your application is using a flow that grants it direct access to student accounts. This blows past "simple" PII concerns into the fact that you are getting students to log your app into their university accounts. It doesn't matter what you claim your app does or doesn't do with that access, getting that access and the mode in which you are doing so is almost assuredly against the terms of service. You are not providing a generalized web browser, you are providing a targeted application, and comparisons to commercial, generalized web browsers aren't going to make much sense or be credible arguments.

Sensitive Data

If Sensitive Data is present in student accounts, and you have failed to gain proper related consent, gaining access to the account and thereby to the data, even if you are not processing it, even if you are not retrieving it or the pages it resides on, may still place you in related jeopardy given the elevated concerns and rules regarding sensitive data.

Integrity and confidentiality

The University, under GDPR, has a duty to maintain both integrity and confidentiality. Your app's access of the accounts by getting students to log your app in is arguably a breach that the University must take action on. You do not have a formal contract with the University to gain access to student accounts within the University's systems, which is what your app is doing.

Consent and Transparency

Do you properly notify students that your app will be logging in to their accounts as them and thus gaining full access to their accounts, while claiming to only using certain data?

Given the accounts you are accessing and the mode in which you are doing so, you have duties under GDPR, you can't treat it simply as "well all I'm having the app directly use is this uri [so I can ignore GDPR processes and concerns]".

Lawful basis

You may not have a lawful basis for your application's access to the student's account in the first place, just to scrape their schedule uri.

If the schedule uri is to a publicly accessible resource, then you could have the student copy and paste the uri into your app without getting them to log your app into their account.

Equally, you could have the student build out their schedule in your application.

Are these things as "convenient" as having the student log your application in, then your application processing their logged in account page to get the uri? From one standpoint, no. But from another, they're also not as inconvenient as engaging in an un-authorized access of university systems and the university system's copies of student PII, which arguably constitutes a breach for the university under GDPR.

You haven't given adequate and clear enough information to answer more directly to "is it illegal"

But I would caution that what you have said sounds like it probably could be considered to be in violation of GDPR from multiple angles, and given most University policies likely violates your University's policies as a student.

I'm not familiar enough with EU law to be able to even offer much opinion on whether gaining access to student accounts like this, even if you "don't do anything" with that access other than what you claim, is necessarily illegal in the sense of being a criminal act (in the US, especially with having been told explicitly that you are not authorized, it could certainly be considered and charged as such under CFAA at least, and possibly other state and federal acts). Factors such as whether you are intentionally spoofing as a web browser (changing the agent string in the headers or otherwise) to gain access, etc, would surely also come into play.

Separately, note that when it comes to things like OAuth, using embedded web views is considered a regressive pattern, and platform providers are supposed to attempt to avoid allowing it to the best of their ability. (see: OAuth "Use a System Browser") (Apple's version of what OAuth advises in terms of leveraging available on device APIs would be, for example, ASWebAuthenticationSession as described in "Authenticating a User Through a Web Service")

Personally, my concern would be that if your actions breach the University's own duties under GDPR, they would in that theory have a duty to report them as a breach, which may place you at minimum in a situation where you are investigated by law enforcement and may have some liability. Even if it's impossible to say whether or not what you are doing is truly "illegal" without being charged with something and it going to court, particularly in the criminal sense, my concern would be one where it certainly seems like something with at least civil jeopardy aspects, and my understanding is that GDPR violations are pursued relatively stringently. I would find a route to do this that doesn't involve gaining access to student accounts using the student's direct login, personally.

4
  • 1
    "the University is 100% correct if they are taking that stance, because at minimum your actions can be seen as a breach of their GDPR duties." That seems absurd on its face. By definition, we are talking about the university's duties, not anyone else's. It could becomes yours if you need some credentials and have a contract with them but it cannot create obligations and liabilities for everybody in the world. Conversely, would you say their duty to secure the data is satisfied as long as nobody in the world is exploiting a weakness at the moment?
    – Relaxed
    Commented Oct 1, 2023 at 7:50
  • 1
    ‘Even without being a GDPR expert by any stretch’ – you should have ended there.
    – SCP-738
    Commented Oct 1, 2023 at 8:38
  • @Relaxed it was a more loosely worded phrase than it should have been. The issue is that once the University is aware of the activity, they have a duty to prevent it. I've updated the quoted passage to better reflect that intended meaning.
    – taswyn
    Commented Oct 1, 2023 at 23:21
  • 1
    @taswyn How are they responsible for how third parties handle data?
    – vidarlo
    Commented Oct 2, 2023 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .