How does the GDPR affect a personal blog?

Question

The General Data Protection Regulation (GDPR) (EU) is a regulation in EU law on data protection and privacy for all individuals within the European Union.

-- Wikipedia

I have a low-traffic, personal blog hosted on GitHub Pages. It uses Google Analytics, AdSense, and Disqus. I don't currently have a contact form, but I may add one. I have visitors from the EU / EEA, but not because I target anyone who lives there.

In terms of Google Analytics, I don't track user IDs, demographic information, or use "remarketing" functions outside of the default configuration. (See "Granular opt-ins" at "How to make your static website GDPR compliant in examples".)

What action(s) do I need to take for GDPR before May 25th, 2018?

For example:

• "Prior consent on other than strictly necessary cookies"
• "Prior consent on personal data"

Answer 1

Do you need to? No, of course not.

But you'll be out of compliance if you don't.

Whether you target EU visitors or not is immaterial. If they arrive at your site, you need to get consent. You need to disclose in plain language what personal data you collect, how you collect it, under what legal basis (there are only a few valid legal bases), and who else sees these data (Google and Disqus at least, probably much more).

There's a technical part of it, too. You can't serve anything except strictly necessary cookies before getting consent. If they arrive at the site, and your site puts the GA cookie on their computer before you've gotten consent, you're in violation.

I'm in the middle of doing this for my site, and it's work. I suggest you investigate very soon.

Answer 2

This really hinges on extra-territorial application of law. The question is probably rather "do I have to do anything?", and the answer is probably "not if you serve your site from the US" because, quite fortunately and thankfully, we still have national borders and national laws.

If you serve your site from outside of EU you do not care what laws they have there. They could have a law that forces web site owner to paint themselves orange every time a user comes to visit. Do you have to do it if you live in the USA and serve your site from USA? No. I challenge EU to enforce their laws on US residents. Good luck to them.

Now, can EU sanction your site for being non-compliant? They probably can if someone complains enough about you, but again, I'd give them Forest Gump's response to "I'd like to see that". We certainly do not have to go out of our way to volunteer extra-territorial compliance.

This is of course based on the assumption that GitHub is a California, USA company, and that your blog is served from a US server. Them serving from a EU-based CDN has no bearing because it is the initiative of GitHub, not you. Your intent is to be served from the US, and it is the US entity with which you have entered into a hosting agreement.

Answer 3

If your "personal blog" is available to the public audience, it would not fall under the "personal or household activities" exemptions in the GDPR.

Personal or household activities – personal data processed in the course of a purely personal or household activity, with no connection to a professional or commercial activity, is outside the GDPR’s scope. This means that if you only use personal data for such things as writing to friends and family or taking pictures for your own enjoyment, you are not subject to the GDPR.

Therefore, it would fall under the EU GDPR and you must use all the technical requirements to ensure personal data of your visitors are processed accordingly. If you are an IT professional you need to work on this with solicitor specialised on GDPR.