GDPR @&#160;ePrivacy &amp; Data Controller &amp; Local processing PII &amp; Mobile App
<p>I'm developing an open source client mobile app that allows user to use third-party social media. So the app logs in directly to the interface with the credentials entered by the user and makes direct requests to it. Will the app developer be considered the data controller even though I do not have access to the user's data and the app does not make any requests to my server? All data is processed in memory but the credentials are stored into user's device local storage.</p>
<p>For example, Infinity For Reddit and Nitter.</p>

<p>Data controller is whoever determines the purposes and means of processing. But one app might be involved in lots of different processing activities, and they might have different controllers.</p>
<p>Clearly, the app developer cannot control for what purposes a third-party social media service might use the data. So the app developer wouldn't be controller for the activities on the social media backend. But the app developer is responsible for sending personal data to the third party service in the first place. And some processing activities might relate solely to the app, not to the social media service, for example analytics or crash reports.</p>
<p>Relevant case law here is the <em>Fashion ID</em> case, where the CJEU found that website operators who embedded a Facebook “Like” button on their pages are data controllers for the data collection via this embedded button, but not for what Facebook subsequentially does with the data.</p>
<p>If the app developer is the data controller for sending personal data to the social network, there would be the question of legal basis. However, this will typically be Art 6(1)(b) necessity for performing a contract with the data subject (providing the core services of the app), or maybe consent. This is not going to be a hurdle.</p>
<p>EPrivacy issues like access to on-device storage are squarely on the app developer – the remote service has no part in that.</p>

gdpr privacy