gdpr european-union
Do I need to consider GDPR when conducting a survey for a personal project from people in a public Facebook group within the EU?
<p>I am a member of a Facebook group that exists to help people apply for citizenship and provide advice in the process. The timeline for applying for citizenship varies wildly depending on a number of factors. I would like to create a survey of its members who have been successfully granted citizenship. This would be beneficial for me personally, and I would also like to share the results within the group.</p>
<p>Is this permitted within the laws of GDPR?</p>
<p>I work for a university but this is wholly unrelated to my research and would be a personal project. Do I, as a private individual, still have to follow GDPR regulations? Or does GDPR not extend to private individuals?</p>

<p>GDPR probably applies.</p>
<p>The GDPR does not make a distinction between natural persons and corporations, or between “private individuals” and businesses. Any processing of personal data is covered.</p>
<p>There is a GDPR exception when the processing is done for <em>purely personal or household purposes</em>. In particular, ordinary social media use is explicitly covered by this exception. But case law (such as the CJEU <em>Lindqvist</em> case) suggests that this word “purely” requires a narrow interpretation of this exception – it is likely that your survey wouldn't be exempt, and would then have to comply with GDPR rules. In particular, the survey would involve data from an indeterminate number of data subjects to which you have no prior personal relationship, suggesting that you aren't running the survey for purely personal or household purposes.</p>
<p>Other potential arguments why GDPR might not apply, and why they don't hold in your case:</p>
<ul>
<li><p><em>Lack of material scope – no relevant means of processing</em>: GDPR only applies when the processing of personal data is done using electronic means, or when the data is intended to be incorporated into a filing system.</p>
<p>But here you propose to use an online survey, which definitely involves electronic means.</p>
<p>As an example of a survey method that <em>might</em> be GDPR-exempt, consider in-person or telephone interviews  where answers are not recorded individually but are immediately aggregated on a tally sheet. This might sidestep issues of creating a filing system.</p>
</li>
<li><p><em>Lack of material scope – no personal data</em>: GDPR only applies if the processing activities involve personal data. Personal data is any information relating to an identifiable person, where identification also includes indirect identification with the help of additional information and third parties, or just being able to single out one data subject's records. If there are no reasonable means that could likely lead to identification, the data is truly anonymous and GDPR wouldn't apply. Aggregate statistics are often anonymous.</p>
<p>But while the results of your survey might not be covered by GDPR, the individual survey responses would definitely be personal data. Conducting the survey involves processing these responses, so that these activities would be covered by GDPR.</p>
</li>
<li><p><em>Lack of territorial scope</em>: GDPR only applies (1) if the processing activities are performed in the context of an EU/EEA/UK establishment, or (2) if the processing relates to the offering of goods or services or monitoring of behaviour of people who are in the EU/EEA/UK.</p>
<p>But since you live in the EU, criterion (1) is fulfilled and GDPR applies. Even if not, your survey seems to be directed to people who are in the EU, so that criterion (2) would also apply.</p>
</li>
</ul>
