internet gdpr website
GDPR data portability when no data stored
<p>My website is processing IP addresses to automatically select the language for the site, however these IP addresses are not stored in the database. Even though the visitors give consent, do they have the right to data portability? There's no data stored for me to send them. If a visitor tried to exercise this right, what should I do as the owner of such website? Just tell them there's no data?</p>

<p>You clearly cannot provide data that you haven't stored – and not storing data is a good thing under the Art 5(1)(c) Data Minimization Principle. Despite the Art 20 data portability right being conditional on that the data subject has provided data and not on that data has been stored, I think responding to such a request with “sorry, as per our privacy policy we do not store this data” would be perfectly fine.</p>

<p>It is also curious that you are using <em>consent</em> as the legal basis for the purpose of selecting the website language. How do you obtain consent from visitors? How can you prove that you got consent? In many ways, consent is the legal basis of last resort, and I'd think that <em>legitimate interest</em> would be a much more straightforward approach in your case.</p>
