I have a friend who insists that material sent to me by a client as part of the proposed content of a website they are contracting me to build can qualify as sensitive data and as such can fall foul of the EU's new GDPR regulation.
So taking the following example: I have a customer who contracts me to build them a website. They provide me with the content that they want on the pages (a publicly-accessible website that anyone with an internet connection can see). If that content contains personal info (e.g. names, photos, employment history) then I, as the web-developer, am now in possession of "sensitive information" and need to abide by all the relevant legislation for handling this information; despite the fact that they have given me this of their own volition with the express purpose of displaying it publicly on their website.
To be clear, according to what I am being told, if I was being tasked with building a web page with staff info like this one for example, then having the client send me the staff names and photos means that I am now "processing personal data".
This seems ridiculous to me, and not what the regulation was intended for; namely the soliciting and harvesting of personal information for targeted-marketing purposes, which is obviously not at all what is happening here. Surely if I am simply sent a mass of material and asked to put it on a website then by doing so I am merely fulfilling a contract?
What are your thoughts on this? Thank you.
