3

The General Data Protection Regulation (GDPR) (EU) is a regulation in EU law on data protection and privacy for all individuals within the European Union.

-- Wikipedia

I have a low-traffic, personal blog hosted on GitHub Pages. It uses Google Analytics, AdSense, and Disqus. I don't currently have a contact form, but I may add one. I have visitors from the EU / EEA, but not because I target anyone who lives there.

In terms of Google Analytics, I don't track user IDs, demographic information, or use "remarketing" functions outside of the default configuration. (See "Granular opt-ins" at "How to make your static website GDPR compliant in examples".)

What action(s) do I need to take for GDPR before May 25th, 2018?

For example:

  • "Prior consent on other than strictly necessary cookies"
  • "Prior consent on personal data"
1

3 Answers 3

1

Do you need to? No, of course not.

But you'll be out of compliance if you don't.

Whether you target EU visitors or not is immaterial. If they arrive at your site, you need to get consent. You need to disclose in plain language what personal data you collect, how you collect it, under what legal basis (there are only a few valid legal bases), and who else sees these data (Google and Disqus at least, probably much more).

There's a technical part of it, too. You can't serve anything except strictly necessary cookies before getting consent. If they arrive at the site, and your site puts the GA cookie on their computer before you've gotten consent, you're in violation.

I'm in the middle of doing this for my site, and it's work. I suggest you investigate very soon.

5
  • Thanks for the response. I may be misunderstanding, but it seems like part of this answer doesn't match up with this writeup. See "Granular opt-ins" here: getpublii.com/blog/website-gdpr-compliant.html Commented May 19, 2018 at 13:01
  • Your questions seemed to be more of the flavor "do I need to do anything" vs. "do I need to do X." I was saying, "Yes, you do need to be concerned about GDPR." But responding to your comment: Granular consent is still consent.
    – John
    Commented May 19, 2018 at 16:47
  • "the basic configuration of Google Analytics which most people will use does not collect any identifying information and doesn't conflict with the GDPR, so no consent is required from the user" Commented May 19, 2018 at 18:13
  • @BenjaminOakes how do you say that? Commented May 21, 2018 at 11:21
  • It's a quote from getpublii.com/blog/website-gdpr-compliant.html Commented May 21, 2018 at 13:02
1

This really hinges on extra-territorial application of law. The question is probably rather "do I have to do anything?", and the answer is probably "not if you serve your site from the US" because, quite fortunately and thankfully, we still have national borders and national laws.

If you serve your site from outside of EU you do not care what laws they have there. They could have a law that forces web site owner to paint themselves orange every time a user comes to visit. Do you have to do it if you live in the USA and serve your site from USA? No. I challenge EU to enforce their laws on US residents. Good luck to them.

Now, can EU sanction your site for being non-compliant? They probably can if someone complains enough about you, but again, I'd give them Forest Gump's response to "I'd like to see that". We certainly do not have to go out of our way to volunteer extra-territorial compliance.

This is of course based on the assumption that GitHub is a California, USA company, and that your blog is served from a US server. Them serving from a EU-based CDN has no bearing because it is the initiative of GitHub, not you. Your intent is to be served from the US, and it is the US entity with which you have entered into a hosting agreement.

1
  • Breaking the laws of another country means that you would never be able to travel to that country. Commented May 27, 2023 at 10:39
0

If your "personal blog" is available to the public audience, it would not fall under the "personal or household activities" exemptions in the GDPR.

Personal or household activities – personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the GDPR.

Therefore, it would fall under the EU GDPR and you must use all the technical requirements to ensure personal data of your visitors are processed accordingly. If you are an IT professional you need to work on this with solicitor specialised on GDPR.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.