united-kingdom internet gdpr
I have created an App to help isolated people in Corona Virus lockdown. Do GDPR rules apply
<p>I have created an App at <a href="https://helpathome.me" rel="noreferrer">helpathome.me</a> which isolated people can use to fill out a form and request help from others.</p>

<p><a href="https://i.stack.imgur.com/X0MUs.png" rel="noreferrer"><img src="https://i.stack.imgur.com/X0MUs.png" alt="enter image description here"></a></p>

<p>I innocently thought this would be fine but a friend told me that I must comply to GDPR rules and that when it goes live it shows information directly to the public which could be used inappropriately.</p>

<p>Further more he said that if some not so nice person was to use the data of somebody asking for help and then go to their house and commit some type of crime then I would be liable because I provided the facility for them to meet. </p>

<p>I really want to role this out in my local area (maybe larger area if I have the resources to manage it) but before I do I want to make sure I'm not setting myself up for some nasty legal issues. I would also like any recommendations as to what I can do if anything to the app to make it more secure and compliant) Thanks . I am in the UK</p>

<p>Yes, GDPR applies:</p>

<ul>
<li>you are a data controller established/living in the UK or are offering services to people in the UK</li>
<li>you fall under the material scope of the GDPR. The Art 2(2)(c) exemption for “purely personal or household activity” does not apply since you're offering the service to the public.</li>
</ul>

<p>You must consider GDPR compliance here. This is especially important as you are showing personal data to the <em>public</em>. Don't do that unless you have a very good reason, appropriate safeguards, and are clear to users how their information will be shown.</p>

<p>On a high level, GDPR compliance involves working on the following questions:</p>

<ul>
<li><p>For what <em>purpose</em> are you processing personal data?</p>

<p>Context: purpose limitation principle per GDPR Art 5(1)(b)</p></li>
<li><p>What is the <em>legal basis</em> for processing?</p>

<p>GDPR Art 6(1) lists the available legal bases. Here, consent, necessity for performance of a contract, or a legitimate interest could be a legal basis. They may have further obligations attached. A legitimate interest requires a balancing test that considers the data subject's rights and freedoms. Consent must fulfil the conditions per Art 7 in order to be valid.</p></li>
<li><p>What is the <em>minimal data necessary</em> to achieve the purpose?</p>

<p>Per the Art 5(1)(c) data minimisation principle, it is illegal to process personal data beyond what is necessary and adequate. You must provide <em>data protection by design and by default</em> per Art 25. Special categories of data per Art 9 such as health data are illegal to process outside of narrow exemptions. You must delete data once it is no longer necessary.</p></li>
<li><p>What <em>appropriate safeguards</em> and security measures should you apply?</p>

<p>Per Art 24 and 25, you are responsible for determining and implementing appropriate measures. This depends a lot on your specific context, so there's no checklist you can apply. Per Art 25(1) you must pseudonymize the processed information if that is compatible with the processing purpose.</p></li>
<li><p>What <em>further compliance measures</em> do you have to consider?</p>

<p>There are additional GDPR and non-GDPR compliance measures. From the GDPR side:</p>

<ul>
<li>Use the answers to these questions to write a privacy policy, including the information that you must provide to data subjects per Art 13.</li>
<li>Consider whether you have to maintain a Records of Processing document per Art 30, or if you have to make a Data Protection Impact Assessment per Art 35. </li>
<li>If you use third party services, figure out whether they are a <em>joint controller</em> or <em>data processor</em> and apply appropriate safeguards.</li>
<li>If you have data processors, ensure that you have a contract in place that covers the items from Art 28(3).</li>
<li>If you share data with other controllers (not processors) you need a legal basis for doing so.</li>
<li>If you transfer data into a non-EU/EEA country (after 2020: non-UK country) you need a legal basis per Art 44 and have to cover additional items in your privacy policy. Ideally, the target country is covered by an EC adequacy decision per Art 45. For US-based companies, this is the case only when they have self-certified under the Privacy Shield framework.</li>
</ul>

<p>Non-GDPR compliance steps could include cookie consent banners, or showing a VAT ID.</p></li>
<li><p>How can you prepare for <em>data subject requests</em>?</p>

<p>Data subjects have various rights per Arts 15–23, subject to the modalities in Art 12. For example, a data subject could request that their information is erased from your website. The exact rights also depend on the legal basis you selected. You should figure out in advance how to deal with such requests.</p></li>
</ul>
