GDPR - User entering other peoples data
<p>I would like to build a software application; a party planner, that allows the user to register his guests and RSVP.</p>

<p>Managing a guest list of 50-100 people can be tough, and a tool would help out a lot.</p>

<p>But the user would enter private information about other people, without their consent.
Obviously, the information would be kept safe, and not be used to any other purpose than what the user decides, and can be deleted/wiped at any time.</p>

<p>I suppose this is the same use case for CRM systems and event registration systems.</p>

<p>How would my application be affected by GDPR and similar laws?</p>

<p>The information the user enters is not supposed to be owned by me, and I have no right or say over what is entered.</p>

<p>The GDPR does not require the consent of the data subjects for processing. The GDPR requires that you have <em>a</em> legal basis for processing per Art 6. Here, there might be a <em>legitimate interest</em> for processing, in particular the legitimate interest of the party planner. Before relying on legitimate interest as a legal basis, you must do a balancing test to ensure that the legitimate interest outweighs the affected rights and freedoms of the data subject. You should also implement safeguards to limit abuse.</p>

<p>However, a key GDPR principle (Art 5) is transparency. Putting up a privacy policy on your website is not good enough, and Art 14 lists various information that you must provide to the data subject if you didn't obtain their personal data from the data subject themselves. You must provide this information within a reasonable period, but at the latest:</p>

<ul>
<li>within one month</li>
<li>at the time of the first communication with the data subject</li>
<li>when the information is disclosed to a third party</li>
</ul>

<p>Here, it seems likely that your system would send out invites to all involved persons. In that invite, you should also make the Art 14 information available, in particular the information that the data subject can object (Art 21) to further processing: legitimate interest means opt-out.</p>

<p>The point of being a data controller vs a data processor is a good one, but doesn't quite apply here. A data processor is bound by some contract per Art 28, which is common/necessary in a B2B context. You could structure your signup flow so that such a contract is formed with the party planner, and the party planner would then be the sole data controller who would be responsible for selecting a suitable legal basis and providing information to data subjects.</p>

<p>But don't do that. Such terms would likely run into consumer protection issues and might be unenforceable. Being a processor is also not a get-out-of-jail-free card, because you still have substantial compliance obligations towards the controller.</p>

<p>More reasonably, you and the party planner are <em>joint controllers</em> per Art 26. The party planner is responsible for legally sharing the data about guests with you and for the processing they do, and you are fully responsible for any data processing or storage you do. This is the model under which consumer-facing internet services generally operate.</p>

gdpr consent