3 ms·

> Is that really true? Best I can do is offer my interpretation. GDPR applies to "[...] the processing of personal data wholly or partly by automated means" [1

> Is that really true? Best I can do is offer my interpretation. GDPR applies to "[...] the processing of personal data wholly or partly by automated means" [1]. I take "automated means" to include this app. So when this app runs and processes EU citizens' data, the law applies. But to what or whom... > I don't see how the author of this application is a data processor (or a data controller) ... I understand as follows: things are generally not responsible under the law, their owners and creators are. If I install and use a software, the GDPR entitles me to knowledge of its personal data processing capabilities if it processes personal data, which this app seems to do. As the GDPR evolved from consumer protection law, I'll employ an analogy: if I win a free vacuum cleaner in a raffle, the product still needs to include a safety guide - the manufacturer or distributor can't delegate safety responsibility to me. GDPR is about personal data safety. > If an email client run by a user on his own machine with no involvement of the vendor of that software requires "a valid data privacy statement" Conversely, at least one mainstream email client comes with a data privacy statement [2]. Which doesn't prove my point, it might be just ass-covering. > then so does probably the user's keyboard driver. Maybe the operating system's data privacy statement covers this? Otherwise that reasoning appears sound. [1] https://gdpr-info.eu/art-2-gdpr/ https://gdpr-info.eu/art-2-gdpr/ [2] https://www.mozilla.org/en-US/privacy/thunderbird/ https://www.mozilla.org/en-US/privacy/thunderbird/

jhgb 4y ago
Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. If this application doesn't collect any such data for its author, then this point goes away. If you are using the software, then you're processing your own data. I'm not sure that provenance of your tools has any bearing on it. Even just 2(c) in [1] would disqualify it.
- ggeorgovassilis 4y ago
  > Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. According to the data privacy statement (DPS) it does more than that, refer to chapter "Set-Up and Configure Your Email": Thunderbird collects your email domain and other technical data to set-up and configure your email account. Other information, like your name, your email messages, and your account’s address book are stored locally on your computer and never sent to us. "Thunderbird" means the email client, not the web service ("us"). The DPS cleanly separates between data stored locally on the client and data shared with the servers - the DPS addresses both scenarios and it explains which data is stored locally, so their interpretation is that GDPR covers data processed by the application which does not leave the client, too. > If this application doesn't collect any such data for its author, then this point goes away The Thunderbird DPS seems to think otherwise, as it describes the locally stored data even if it isn't submitted to the web service. Maybe the DPS doesn't intend to apply a legal interpretation to local data and mentions local data only for contrast to shared data, which the DPS definitely cares about? Hence my in-earlier-comment comment that this might be just ass-covering without legal weight.
  - jhgb 4y ago
    I was talking purely about what the GDPR might require you to do. That Thunderbird tells you more in no way necessarily means that GDPR requires it. GDPR doesn't prevent you from voluntary disclosing information. With extremely high likelihood, telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do. Not to mention that privacy statements don't necessarily have to satisfy just one party. A single privacy statement may incorporate clauses to satisfy all the local requirements that an internationally operating entity making that statement is obligated to satisfy.
    - ggeorgovassilis 4y ago
      > telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do That's exactly what the GDPR enforces. You give the app personally identifying data, so the app needs to disclose what it does with the data because storing it on the computer and not sending it anywhere is still data processing. In this case the data privacy statement needs to tell the user that the data is stored but not shared. If you're not doing anything with the data, then don't ask for it.
      - jhgb 4y ago
        Please show me where the GDPR talks about the behavior of software as opposed to the behavior of legal entities. To my knowledge, GDPR puts limits on what legal entities do to other people. Software is not a legal entity.

jhgb 4y ago

Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. If this application doesn't collect any such data for its author, then this point goes away. If you are using the software, then you're processing your own data. I'm not sure that provenance of your tools has any bearing on it. Even just 2(c) in [1] would disqualify it.

ggeorgovassilis 4y ago
> Thunderbird's privacy statement literally talks about collecting data on its users through telemetry. According to the data privacy statement (DPS) it does more than that, refer to chapter "Set-Up and Configure Your Email": Thunderbird collects your email domain and other technical data to set-up and configure your email account. Other information, like your name, your email messages, and your account’s address book are stored locally on your computer and never sent to us. "Thunderbird" means the email client, not the web service ("us"). The DPS cleanly separates between data stored locally on the client and data shared with the servers - the DPS addresses both scenarios and it explains which data is stored locally, so their interpretation is that GDPR covers data processed by the application which does not leave the client, too. > If this application doesn't collect any such data for its author, then this point goes away The Thunderbird DPS seems to think otherwise, as it describes the locally stored data even if it isn't submitted to the web service. Maybe the DPS doesn't intend to apply a legal interpretation to local data and mentions local data only for contrast to shared data, which the DPS definitely cares about? Hence my in-earlier-comment comment that this might be just ass-covering without legal weight.
- jhgb 4y ago
  I was talking purely about what the GDPR might require you to do. That Thunderbird tells you more in no way necessarily means that GDPR requires it. GDPR doesn't prevent you from voluntary disclosing information. With extremely high likelihood, telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do. Not to mention that privacy statements don't necessarily have to satisfy just one party. A single privacy statement may incorporate clauses to satisfy all the local requirements that an internationally operating entity making that statement is obligated to satisfy.
  - ggeorgovassilis 4y ago
    > telling the user that your computer will remember your e-mail address in an application completely under your control that will never send it anywhere else on its own, just so that you wouldn't have to re-type it every time, is not something that GDPR forces you to do That's exactly what the GDPR enforces. You give the app personally identifying data, so the app needs to disclose what it does with the data because storing it on the computer and not sending it anywhere is still data processing. In this case the data privacy statement needs to tell the user that the data is stored but not shared. If you're not doing anything with the data, then don't ask for it.
    - jhgb 4y ago
      Please show me where the GDPR talks about the behavior of software as opposed to the behavior of legal entities. To my knowledge, GDPR puts limits on what legal entities do to other people. Software is not a legal entity.