gdpr personal-information sweden
Publishing personal data obtained on a Swedish server - GDPR implications
<p>Imagine a small social media chat platform is hosted in Sweden and subject to GDPR. Party A sends personal information to party B using the platform, using a private message. The information was provided directly to party B, and was not collected using any automated means. Party B publishes this personal information on the same platform in the form of a public message. Neither party A nor party B are in a country subject to GDPR.</p>
<p>Does party A have any recourse against the platform through the GDPR?</p>
<p>Consider a <em>hypothetical</em> series of events:</p>
<ul>
<li>Alice contacts Bob in a private message over Platform and provides him with her full name</li>
<li>Alice pisses Bob off and Bob, in a petty act of revenge, publishes Alice's personal information in a public space on Platform to &quot;name and shame&quot; her</li>
<li>Platform refuses to delete the message Bob posted as it is not against their terms of service</li>
<li>Alice is gets angry at this action and tries to take legal action against Platform, claiming a GDPR violation for Platform's refusal to remove the information</li>
</ul>

<p>I don't think that GDPR applies here.</p>
<p>There are three actors: Alice, Bob, and the Platform. Bob published Alice's personal data through the Platform. Then, we have to consider who of them would be the data controller for this processing activity. Only the controller would be responsible under GDPR for compliance and for handling data subject requests.</p>
<p>I will take it as a given that the scenario involves the processing of Alice's personal data.</p>
<p>I also want to highlight the detail that neither Alice nor Bob are in a country where GDPR applies.</p>
<p>Clearly, the Platform is the data controller for most aspects of their service. However:</p>
<ul>
<li>Controller is whoever determines the purposes and means of processing (Art 4(7)).</li>
<li>The GDPR does not apply to processing by a natural person in the course of a purely personal or household activity (Art 2(2)(c)), which includes “social networking and online activity undertaken within the context of such activities” (Recital 18).</li>
<li>The GDPR would only apply to processing activities that occur in the context of an European establishment of the controller, or when those activities are related to the offering of goods or services to people who are in Europe.</li>
</ul>
<p>This leads me to the following conclusions:</p>
<h3>Only Bob is the data controller for message contents.</h3>
<p>When Bob posts a message, the Platform does not exert control over the message contents. The Platform is controller for how they process Bob's and Alice's messages, but it does not control the purposes and means for processing conducted via such messages.</p>
<p>Bob used the Platform for the processing activity of publishing Alice's personal data, and is the controller of that activity.</p>
<h3>Alice cannot rely on GDPR against Bob due to issues of territorial scope.</h3>
<p>In a nutshell, Art 3 GDPR says that GDPR can only apply if one end of the subject–controller relationship is in Europe. Since the Platform is EU-based, both Alice and Bob are protected by GDPR with respect to the platform's processing activity.</p>
<p>However, this is irrelevant when considering the Alice–Bob relationship. Bob does not have an European establishment, so is not subject to GDPR per Art 3(1). Bob does not offer goods or services to people who are in Europe, so is not subject to GDPR per Art 3(2).</p>
<p>Even if Bob were to offer goods or service to people in Europe, Alice wouldn't be covered by GDPR because Bob's processing of Alice's data wouldn't be “related” to such offering, unless perhaps this Platform is some kind of marketplace.</p>
<h3>Bob might have to comply if he was EU-based.</h3>
<p>If Bob was EU-based, things would be more interesting. Now, Bob would clearly be in the GDPR's Art 3 territorial scope, but we must also consider the Art 2 material scope.</p>
<p>If Bob is an individual and not a company, Bob might invoke the household exception that exempts normal social media use. However, taking into account CJEU case law from <em>Rynes</em> and <em>Lindqvist</em>, making the data public is unlikely to fall under this narrow exemption.</p>
<p>So in this alternative scenario, Bob might be in scope of the GDPR as a data controller, and would then have to comply with its requirements.</p>
<h3>Even if GDPR were to apply, deletion may not be required.</h3>
<p>“Only a Sith deals in absolutes”, and the GDPR is very much not a Sith. It is based around foundational principles in Art 5, and these must be carefully balanced with other rights.</p>
<p>Bob might have an Art 6(1)(f) <em>legitimate interest</em> in publishing a “name and shame” post. This would depend on the specific context, though.</p>
<p>Bob might be covered by an Art 85 GDPR exception for <em>freedom of expression and information</em>, in particular if the data was published for journalistic purposes. However, such exemptions must be provided by member states.</p>
<p>Bob might not have to fulfil an Art 17 erasure request if none of the deletion criteria are met, in particular if Bob's legitimate interest in publication would override Alice's objection, or if publication is necessary for exercising the right of freedom of expression and information.</p>
<p>These carve-outs for freedom of expression are important, e.g. to prevent a public figure from abusing GDPR to silence public criticism.</p>
<h3>The Platform <em>might</em> have an obligation to provide safety features.</h3>
<p>As discussed above, I don't think that the Platform is a controller regarding Bob's publication.</p>
<p>However, data controllers have general obligations to ensure the compliance and security of their own processing, which requires the adoption of appropriate technical and organizational measures. In particular, the Platform must ensure data protection by design and by default (Art 25).</p>
<p>Perhaps this could be interpreted to require safety features on the Platform, such as content visibility settings and moderation flags. However, it is not reasonable to interpret this in a way that would force the Platform to censor or delete otherwise-legal content.</p>
<h3>GDPR is the wrong mechanism here.</h3>
<p>GDPR is a fairly high-profile law, and is sometimes used in ways that it wasn't designed for. For example, the right to access is sometimes used as a kind of Freedom of Information device, and misunderstandings about the GDPR's territorial scope often see international data controllers being wrongly threatened with it.</p>
<p>This scenario is different in that it could be legitimately viewed as a data protection issue between Alice and Bob, if that relationship were subject to GDPR.</p>
<p>But it is not appropriate to use the GDPR against the Platform here, since the Platform is not the data controller for the processing activity in question. Instead, Alice would have to find some other reason why the Platform would be liable in some way. For example, if Bob's message were to constitute some kind of illegal doxxing, and Swedish rules were to hold platforms liable when they are informed of illegal user content, then Alice would likely be able to get Bob's content taken down.</p>
<p>Alice could also consider whether some other rights were violated by Bob's message. For example, if Bob's message was defamatory, violated personality rights, or breached some duty to confidentiality of communications, then Alice might be able to get Bob to take the content down. But this would depend primarily on the laws in Bob's location.</p>
<p>Someone mentioned the issue of copyright. Mere data such as a name is not covered by copyright. However, if Bob published material written by Alice, and this publication is not covered by a copyright exception, then it might be possible to get Bob's post taken down. There is a small hiccup here that Alice might have already given the Platform the necessary rights to publish her writing via the Platform terms of service.</p>

<p>Edited. As the question was initially asked, I assumed that Bob had simply re-posted the message from Alice with personal details. Since that is not the case, the copyright to the original message does not help here.</p>
<p>What is left is a case of <a href="https://en.wikipedia.org/wiki/Doxing" rel="nofollow noreferrer">doxing</a>, and it should be irrelevant <em>where</em> Bob got Alice's contact details and that Alice is also a user of the platform.</p>
<p>To comply with GDPR in a structured way, the platform will have documented what data they store, and why, and how they process and handle it. For instance, they might have IPs in their access logs, and keep those just for a day for technical troubleshooting. Afterwards, there is no more reason to have them, so there is every reason to delete them. Billing information might be kept a certain number of years, <em>even if the data subject makes a deletion request</em>, to comply with tax regulations. Account information is kept until the account is deleted, and so on.</p>
<p>In this documentation, the content of a message by some user (i.e. Bob) would be <strong>associated with that user's account</strong>, even if it is about a different person who may or may not be a user of the platform (i.e. Alice). The platform did stop there, not even trying to make a judgement if the content did disclose Alice's personal data. I'm not quite convinced by the suggestion by <a href="https://law.stackexchange.com/questions/91532/publishing-personal-data-obtained-on-a-swedish-server-gdpr-implications/91552#91552">amon</a> that Bob is the data controller and the platform is merely the data processor regarding this content, but the (usually reasonable) classification of the data keeps it out of scope for Alice's requests.</p>
<p>Various countries have anti-doxing laws, usually criminal laws to prevent harassment and intimidation.</p>
