4 ms·
Unfortunately, a judge can always say that using an external resource was not necessary to fulfil a user request. As they did in the judgement I linked to. A
by TekMol 3y ago
Unfortunately, a judge can always say that using an external resource was not necessary to fulfil a user request.
As they did in the judgement I linked to.
A judge can always claim you could have used a local version of whatever external resource you used.
- olivierduval 3y agoOf course... or he can say that you could use another resources that is GDPR compliant and/or privacy preserving. YOU provide the service so YOU are responsible for the way your user's data are processed and must ensure that it's processed according to the rules (requiring consent when necessary)
- jdietrich 3y agoA judge can say anything they like, but that doesn't mean it'll be upheld at appeal. If you can use a local version of an external resource, you should. Minimisation is an integral principle of GDPR. There are plenty of circumstances where it would be impractical or impossible to perform a necessary function without sharing data with third parties, but that still needs to be done with appropriate thought and care. I would have a great deal of confidence in embedding a resource provided by Stripe; I would have absolutely no confidence in embedding a resource provided by Google.
- josefx 3y agoAnd if that is the first GDPR related offense you get away with a slap on the wrist.