gdpr freedom-of-speech website
GDPR: Can a website not process personal data?
<p>I want to have a website where I publish my own articles.</p>

<p>When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP.</p>

<p>Now, for a split second while the website processes the request, it stores the IP. This is cleared immediately after sending the response (and the webpage is sent to a user).</p>

<p>Suppose there is no other kind of IP logging for my website, nor any user data collection/tracking.</p>

<p>Does this constitute personal data processing?
If so, do I have to register as a "Data Protection Officer"?</p>

<p>Also, is any website able to comply with GDPR, seeing that any webpage visit triggers the processing and response of an IP address?</p>

<p>There is an exception "for journalistic purposes or the purpose of academic artistic or literary expression" (Article 85 in the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679" rel="nofollow noreferrer">GDPR</a>). However this relies on the member states' law.</p>

<p>Edit: Also, there is an exception for personal activity: Article 2, paragraph 2. (c): "by a natural person in the course of a purely personal or household activity" - This would mean that if I do not publish the IP, it's "personal". But replying to an IP would technically imply that I send the IP to the ISP, and routers along the way, so I'm not sure if it's "personal".</p>

<p>If you are processing the IP address in order to respond to the HTTP request, you are definitely processing personal data[1][2][3]. The fact that you are not keeping any logs would be considered a technical measure to reduce the risk associated with processing (and you should definitely do what you can to reduce that risk, including avoiding processing or storing data unless it's actually necessary).</p>

<p>In GDPR, processing needs to have a legal basis (<a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Art. 6 GDPR</a>). In this case, you would probably chose Art. 6(1)(b) (if you have or are preparing to enter into some kind of contract with the data subject and that's why you are processing their data), or Art. 6(1)(f) (your legitimate interest as a controller) as the legal basis for processing the IP address (also don't forget about the all the headers sent by the browser).</p>

<p>So by figuring out what your legal basis is for each category of data, you can process data lawfully and be compliant.</p>

<p>On the question of the <strong>data protection officer</strong>: a DPO is someone who is appointed by you to independently protect the interests of the subjects (you can't do it yourself as that would be a conflict of interest). However, in your case, there is a good chance that you don't need to appoint a DPO. (See <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/" rel="nofollow noreferrer">Do we need to appoint a Data Protection Officer?
</a></p>

<p>The derogations of article 85 probably don't mean that you can ignore GDPR for these purposes, but merely that there will be special provisions (for instance, you can probably not use your right to object to the processing of your data to prevent a newspaper from writing an article about you).</p>

<p>The question of whether this is "a purely personal or household activity" is a little bit more complicated. Recital 18 says:</p>

<blockquote>
  <p>(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.</p>
</blockquote>

<p>If you (or your blogging software) were to integrate Google Analytics for instance, I would say you are quickly entering the realm of "potential adverse effects" on the data subject, and so you should not rely on this as your legal basis for ignoring the GDPR (especially as it would not be super difficult to comply).</p>

<p>In my estimation, if you are practicing anything that could be called journalism, you are very likely out of the scope of the household exception.</p>

<p>Otherwise it's <em>definitely</em> possible to argue that blogging is a personal activity. You should make sure that:</p>

<ul>
<li>You are not doing anything that could be considered commercial or organised</li>
<li>You don't disseminate personal data (this may not be so easy)</li>
<li>You don't pose a risk to the rights and freedoms of the reader (i.e. you don't put their privacy at risk in any way)</li>
</ul>

<p>Alternatively, you may chose to spend the time (and money) to create a privacy policy and be compliant even though you don't necessarily have to.</p>

<p>Sources:</p>

<ol>
<li><a href="http://www.privacy-regulation.eu/en/recital-30-GDPR.htm" rel="nofollow noreferrer">http://www.privacy-regulation.eu/en/recital-30-GDPR.htm</a></li>
<li><a href="https://eugdprcompliant.com/personal-data/" rel="nofollow noreferrer">https://eugdprcompliant.com/personal-data/</a></li>
<li><a href="https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal-data/" rel="nofollow noreferrer">https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal-data/</a></li>
</ol>
