I have a friend who insists that material sent to me by a client as part of the proposed content of a website they are contracting me to build can qualify as sensitive data and as such can fall foul of the EU's new GDPR regulation.

So taking the following example: I have a customer who contracts me to build them a website. They provide me with the content that they want on the pages (a publicly-accessible website that anyone with an internet connection can see). If that content contains personal info (e.g. names, photos, employment history) then I, as the web-developer, am now in possession of "sensitive information" and need to abide by all the relevant legislation for handling this information; despite the fact that they have given me this of their own volition with the express purpose of displaying it publicly on their website.

To be clear, according to what I am being told, if I was being tasked with building a web page with staff info like this one for example, then having the client send me the staff names and photos means that I am now "processing personal data".

This seems ridiculous to me, and not what the regulation was intended for; namely the soliciting and harvesting of personal information for targeted-marketing purposes, which is obviously not at all what is happening here. Surely if I am simply sent a mass of material and asked to put it on a website then by doing so I am merely fulfilling a contract?

What are your thoughts on this? Thank you.

1 Answer 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.