4 ms·

Are you? If the user processes their own data on their own device using your software, you're the data processor?

refulgentis 2y ago
Correct. They are using my software to process their input.
isodev 2y ago
As the app developer you clearly control the means of processing, you are the data controller. You may have opted for “offline processing” which simplifies your compliance, but it is still processing under your control (and subject to change in future updates, which needs to come with a change to your data processing policy with informed user consent).
- tempfile 2y ago
  It is certainly not processing under your control. You don't do anything with the data - none of your computers are involved, you never see or read or copy anyone's data whatsoever. The data subject is processing their own data, using a tool they perhaps don't understand (if the source code is unavailable, for example). The user is at liberty to start or stop the processing at any time. I don't even think this would apply in the pathological case where a bug in the app causes the personal data to be leaked. You didn't leak it, the user did.
mordae 2y ago
Uh-huh. Are we getting privacy policy for sed and grep next? EDIT: meant to reply lower.
District5524 2y ago
No. Data processor has a special meaning (at least under GDPR) and requires you to be a separate entity from the data controller (article 4(8) of GDPR). Just because you process data, will not make you a data processor. A software developer is neither a controller, nor a data processor per se, but the question is why the software processes any personal data. If there is no third person on whose behalf you process data, you might still easily be a data controller and all the privacy related obligations primarily rest on this role. Controllership does not depend on sending any data to remote locations/other apps outside the phone etc., but more on whether there is any personal data processed in the app at all and if there is, the reason for that processing. If you're not processing any personal data, you'll not be a controller, but if you do, you'll be unlikely to be able to skip this responsibility altogether. Considering you'll be the only one knowing exactly what your software can and cannot do with what kind of personal data, you'd better at least explain that to the user. Surely, developers of some software (e.g. compilers) will never be data controllers even if the software can compile software to process personal data... But for many frontend software, like apps, there is no such easy way out unless not processing any personal data at all, including usage data, which is also not an easy thing to do. But that doesn't mean you can just skip the obligation towards the store manageer who says you HAVE to provide a privacy policy even if you don't process any personal data. Similarly, processing for "purely personal or household activity", even by automated means is outside the scope of GDPR in EU, but that will not save you from the privacy policy obligation towards Apple or whomever.
- dcow 2y ago
  What’s the 1 sentence version of your point?
  - refulgentis 2y ago
    Yes, unless someone spells out to you that they're the data controller and taking legal responsibility (think Google Analytics) I know that's the opposite of what they led with, I'm not trying to be cheeky. It's just shorter if you invert the premise and avoid technicalities. In general, on HN, I see people struggling to wrap their mind around that everyone who takes in data has to take it seriously, at least, that's how the app stores view it.
- cyanydeez 2y ago
  If you have tge user enter a arbitrary endpoint, you are explicitly shipping user data off tge device and a foreign actor could use your app to maliciously MITM that arbitrary endpoint. It doesnt mattet if you good faith assume he user of your app is smart wnough to keep the app and that endpoint secure, you are providing a meansnto exfiltrate your app data

Correct. They are using my software to process their input.

As the app developer you clearly control the means of processing, you are the data controller. You may have opted for “offline processing” which simplifies your compliance, but it is still processing under your control (and subject to change in future updates, which needs to come with a change to your data processing policy with informed user consent).

tempfile 2y ago
It is certainly not processing under your control. You don't do anything with the data - none of your computers are involved, you never see or read or copy anyone's data whatsoever. The data subject is processing their own data, using a tool they perhaps don't understand (if the source code is unavailable, for example). The user is at liberty to start or stop the processing at any time. I don't even think this would apply in the pathological case where a bug in the app causes the personal data to be leaked. You didn't leak it, the user did.

mordae 2y ago

Uh-huh. Are we getting privacy policy for sed and grep next? EDIT: meant to reply lower.

District5524 2y ago

No. Data processor has a special meaning (at least under GDPR) and requires you to be a separate entity from the data controller (article 4(8) of GDPR). Just because you process data, will not make you a data processor. A software developer is neither a controller, nor a data processor per se, but the question is why the software processes any personal data. If there is no third person on whose behalf you process data, you might still easily be a data controller and all the privacy related obligations primarily rest on this role. Controllership does not depend on sending any data to remote locations/other apps outside the phone etc., but more on whether there is any personal data processed in the app at all and if there is, the reason for that processing. If you're not processing any personal data, you'll not be a controller, but if you do, you'll be unlikely to be able to skip this responsibility altogether. Considering you'll be the only one knowing exactly what your software can and cannot do with what kind of personal data, you'd better at least explain that to the user. Surely, developers of some software (e.g. compilers) will never be data controllers even if the software can compile software to process personal data... But for many frontend software, like apps, there is no such easy way out unless not processing any personal data at all, including usage data, which is also not an easy thing to do. But that doesn't mean you can just skip the obligation towards the store manageer who says you HAVE to provide a privacy policy even if you don't process any personal data. Similarly, processing for "purely personal or household activity", even by automated means is outside the scope of GDPR in EU, but that will not save you from the privacy policy obligation towards Apple or whomever.

dcow 2y ago
What’s the 1 sentence version of your point?
- refulgentis 2y ago
  Yes, unless someone spells out to you that they're the data controller and taking legal responsibility (think Google Analytics) I know that's the opposite of what they led with, I'm not trying to be cheeky. It's just shorter if you invert the premise and avoid technicalities. In general, on HN, I see people struggling to wrap their mind around that everyone who takes in data has to take it seriously, at least, that's how the app stores view it.
cyanydeez 2y ago
If you have tge user enter a arbitrary endpoint, you are explicitly shipping user data off tge device and a foreign actor could use your app to maliciously MITM that arbitrary endpoint. It doesnt mattet if you good faith assume he user of your app is smart wnough to keep the app and that endpoint secure, you are providing a meansnto exfiltrate your app data