copyright gdpr privacy
Processing screenshots of people&#39;s browser windows on a web server
<p>Suppose that a software developer (April) living in the UK,has created a simple browser plug-in that takes screenshots of a user's  browser windows and allows the user to enhance and &quot;prettify&quot; these screenshots in various ways.</p>
<p>The &quot;enhancing&quot; part of the screenshot processing is done on April's server, which means that all screenshots are uploaded from people's computers to April's over the internet. April has no control over the data that people take screenshots of: it can be their personal email messages, or some copyrighted material, or even their nude pictures.  And all this data ends up on the web server that April owns and contrtols.</p>
<p>Are there some specific kinds of data processing agreement or privacy policy that April needs to offer to users so that she doesn't end up in any kind of legal trouble (with GDPR or any other privacy laws)? Maybe a disclaimer saying something like &quot;by installing this plug-in, you agree not to take screenshots of any illegal/copyrighted material&quot;?</p>

<p>Since the developer is also said to be running the website where screen shots to be edited are stored, and is resident in the UK, it would seem that the GDPR-UK applies. (The EU version may also apply when a user is in the EU.) This means that the Data Controller (DC) must have a lawful basis under <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a></p>
<p>The most plausible basis would seem to be point (b) of article 6 paragraph 1. That reads:</p>
<blockquote>
<p>(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>
</blockquote>
<p>For this to apply, the DC would need to include in a ToS document or in some other relevant document that a user must accept, contractual language in which the Data Subject (DS) agrees to submit data for processing, and the DC agrees to recive, process, and return it.  There would probably be other provisions as well. One of them might be that the content could not itself be unlawful, another that the DS has all needed rights to submit the content for creation of a modified version, yet another that the service could not be used for any unlawful purpose.</p>
<p>However, other GDPR provisions would also apply. In particular, <a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">Article 5</a>, paragraph 1 point (e) reads in relevant part</p>
<blockquote>
<p>[Personal data shall be] kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ...</p>
</blockquote>
<p>this suggest that such screen shots should not be retained indefinitely, but rather deleted securely as soon as the modified versions have been transmuted to ther users who have requested them. While 5. (b) does permit retention for archiving purposes, it is better practice to retain no more thasn needed. Furthermore, if such information is to be retained as an archive, that should be disclosed to the user under <a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">Article 13</a> specifically 13.1(c) and 13.2(a). Those require disclosing the purpose and lawful basis of procession, and the expected time of retention or the criteria used to determine the retention period.</p>
<p>Othre disclosures liosted in article 13 would also apply.</p>
<p>The idea of consent on the basis of &quot;by using this app/site you consent to ...&quot; is not valid consent under the GDPR. Specifically <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">Article 7</a> requires that consent can be withdrawn at any time, and be easy to withdraw.  <a href="https://gdpr-info.eu/recitals/no-32/" rel="nofollow noreferrer">Recital 32</a> states:</p>
<blockquote>
<p>Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. ... Silence, pre-ticked boxes or inactivity should not therefore constitute consent.</p>
</blockquote>
<p>Thus contractual language, explicitly agreed to by the DS, is a much better basis than such implied consent.</p>
