Can handling the proposed content of a website fall foul of GDPR regulation?

[Arch_B]

I am a web-developer. I have a friend who insists that material sent to me by a client as part of the proposed content of a website they are contracting me to build can qualify as sensitive data and as such can fall foul of the EU's new GDPR regulation.

So taking the following example: I have a customer who contracts me to build them a website. They provide me with the content that they want on the pages (a publicly-accessible website that anyone with an internet connection can see). If that content contains personal info (e.g. names, photos, employment history) then I, as the web-developer, am now in possession of "sensitive information" and need to abide by all the relevant legislation for handling this information; despite the fact that they have given me this of their own volition with the express purpose of displaying it publicly on their website.

To be clear, according to what I am being told, if I was being tasked with building a web page with staff info like this one for example, then having the client send me the staff names and photos means that I am now "processing personal data".

This seems ridiculous to me, and not what the regulation was intended for; namely the soliciting and harvesting of personal information for targeted-marketing purposes, which is obviously not at all what is happening here. Surely if I am simply sent a mass of material and asked to put it on a website then by doing so I am merely fulfilling a contract?

What are your thoughts on this? Thank you.

[Amethyst]

https://ico.org.uk/global/contact-us...organisations/
Peridot

[R0b]

Hello

This seems ridiculous to me, and not what the regulation was intended for; namely the soliciting and harvesting of personal information for targeted-marketing purposes, which is obviously not at all what is happening here.

This is exactly what the Regulation was intended to cover (as was the previous 1998 Act), using personal data for marketing purposes is just one aspect of it. The definition of 'personal data' and 'processing' under the GDPR is very wide in scope which I have set out in full below:

"personal data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Based on what you've said, if you are simply being given the data and inserting it into the website, I would probably say you are just a data processor since you are merely taking instructions from your client. When you start to determine the purpose and means of that data, then you become a controller (or in some circumstances a data controller and a processor).

Some of the data supplied to you might not be categorised as 'sensitive' (which is now known as 'special categories of data' under the GDPR). Racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, biometric or genetic data or data about someone's health are all special categories of data under the GDPR. There are more stricter requirements to use this data and unless the data controller i.e. your client can fall into one of the exemptions (I suspect they might rely on the exemption for using it as part of data subject's employment) they would otherwise need explicit consent.

In terms of your obligations as a data processor, I wold suggest you read the following link, particularly the paragraph at the end on liabilities and responsibilities (Article 28-36 of the GDPR governs generally data processors/controllers obligations).

https://ico.org.uk/for-organisations...nce/contracts/

[jaguarsuk]

To add to Rob's comprehensive response above, the way to cover yourself in this instance is to include in your terms of business ther realtionship of you and your client in terms of the GDPR legislation. Define that you are the Data Processor and at all times they will remain the Data Controller, then go on to define what you will do as a Data Processor.

If you get stuck for wording I can probably post the beginnings of what you could include on Monday.