4 ms·

> Distribution of an app that processes personal data without a valid data privacy statement is illegal in the EU Is that really true? For example data process

by jhgb 4y ago

> Distribution of an app that processes personal data without a valid data privacy statement is illegal in the EU Is that really true? For example data processors are bound by GDPR but I don't see how the author of this application is a data processor (or a data controller). In fact I'm not sure that legally "app that processes personal data" is the correct description here, considering the very specific meaning of "to process" in this context. If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement", then so does probably the user's keyboard driver. And the text formatting engine. And the networking stack. Etc. etc.

ggeorgovassilis 4y ago
> Is that really true? Best I can do is offer my interpretation. GDPR applies to "[...] the processing of personal data wholly or partly by automated means" [1]. I take "automated means" to include this app. So when this app runs and processes EU citizens' data, the law applies. But to what or whom... > I don't see how the author of this application is a data processor (or a data controller) ... I understand as follows: things are generally not responsible under the law, their owners and creators are. If I install and use a software, the GDPR entitles me to knowledge of its personal data processing capabilities if it processes personal data, which this app seems to do. As the GDPR evolved from consumer protection law, I'll employ an analogy: if I win a free vacuum cleaner in a raffle, the product still needs to include a safety guide - the manufacturer or distributor can't delegate safety responsibility to me. GDPR is about personal data safety. > If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement" Conversely, at least one mainstream email client comes with a data privacy statement [2]. Which doesn't prove my point, it might be just ass-covering. > then so does probably the user's keyboard driver. Maybe the operating system's data privacy statement covers this? Otherwise that reasoning appears sound. [1] https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ [2] https://www.mozilla.org/en-US/privacy/thunderbird/ https://www.mozilla.org/en-US/privacy/thunderbird/
- jhgb 4y ago
  Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. If this application doesn't collect any such data for its author, then this point goes away. If you are using the software, then you're processing your own data. I'm not sure that provenance of your tools has any bearing on it. Even just 2(c) in [1] would disqualify it.
  - ggeorgovassilis 4y ago
    > Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. According to the data privacy statement (DPS) it does more than that, refer to chapter "Set-Up and Configure Your Email": Thunderbird collects your email domain and other technical data to set-up and configure your email account. Other information, like your name, your email messages, and your account’s address book are stored locally on your computer and never sent to us. "Thunderbird" means the email client, not the web service ("us"). The DPS cleanly separates between data stored locally on the client and data shared with the servers - the DPS addresses both scenarios and it explains which data is stored locally, so their interpretation is that GDPR covers data processed by the application which does not leave the client, too. > If this application doesn't collect any such data for its author, then this point goes away The Thunderbird DPS seems to think otherwise, as it describes the locally stored data even if it isn't submitted to the web service. Maybe the DPS doesn't intend to apply a legal interpretation to local data and mentions local data only for contrast to shared data, which the DPS definitely cares about? Hence my in-earlier-comment comment that this might be just ass-covering without legal weight.
    - jhgb 4y ago
      I was talking purely about what the GDPR might require you to do. That Thunderbird tells you more in no way necessarily means that GDPR requires it. GDPR doesn't prevent you from voluntary disclosing information. With extremely high likelihood, telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do. Not to mention that privacy statements don't necessarily have to satisfy just one party. A single privacy statement may incorporate clauses to satisfy all the local requirements that an internationally operating entity making that statement is obligated to satisfy.

by jhgb 4y ago

ggeorgovassilis 4y ago

> Is that really true? Best I can do is offer my interpretation. GDPR applies to "[...] the processing of personal data wholly or partly by automated means" [1]. I take "automated means" to include this app. So when this app runs and processes EU citizens' data, the law applies. But to what or whom... > I don't see how the author of this application is a data processor (or a data controller) ... I understand as follows: things are generally not responsible under the law, their owners and creators are. If I install and use a software, the GDPR entitles me to knowledge of its personal data processing capabilities if it processes personal data, which this app seems to do. As the GDPR evolved from consumer protection law, I'll employ an analogy: if I win a free vacuum cleaner in a raffle, the product still needs to include a safety guide - the manufacturer or distributor can't delegate safety responsibility to me. GDPR is about personal data safety. > If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement" Conversely, at least one mainstream email client comes with a data privacy statement [2]. Which doesn't prove my point, it might be just ass-covering. > then so does probably the user's keyboard driver. Maybe the operating system's data privacy statement covers this? Otherwise that reasoning appears sound. [1] https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ [2] https://www.mozilla.org/en-US/privacy/thunderbird/ https://www.mozilla.org/en-US/privacy/thunderbird/

jhgb 4y ago
Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. If this application doesn't collect any such data for its author, then this point goes away. If you are using the software, then you're processing your own data. I'm not sure that provenance of your tools has any bearing on it. Even just 2(c) in [1] would disqualify it.
- ggeorgovassilis 4y ago
  > Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. According to the data privacy statement (DPS) it does more than that, refer to chapter "Set-Up and Configure Your Email": Thunderbird collects your email domain and other technical data to set-up and configure your email account. Other information, like your name, your email messages, and your account’s address book are stored locally on your computer and never sent to us. "Thunderbird" means the email client, not the web service ("us"). The DPS cleanly separates between data stored locally on the client and data shared with the servers - the DPS addresses both scenarios and it explains which data is stored locally, so their interpretation is that GDPR covers data processed by the application which does not leave the client, too. > If this application doesn't collect any such data for its author, then this point goes away The Thunderbird DPS seems to think otherwise, as it describes the locally stored data even if it isn't submitted to the web service. Maybe the DPS doesn't intend to apply a legal interpretation to local data and mentions local data only for contrast to shared data, which the DPS definitely cares about? Hence my in-earlier-comment comment that this might be just ass-covering without legal weight.
  - jhgb 4y ago
    I was talking purely about what the GDPR might require you to do. That Thunderbird tells you more in no way necessarily means that GDPR requires it. GDPR doesn't prevent you from voluntary disclosing information. With extremely high likelihood, telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do. Not to mention that privacy statements don't necessarily have to satisfy just one party. A single privacy statement may incorporate clauses to satisfy all the local requirements that an internationally operating entity making that statement is obligated to satisfy.