Are hobby projects exempt from GDPR?
<p>Consider the scenario where a student requires a huge list of names, emails, zipcodes etc. This student makes a little application to scrape the internet and saves all to a public database.</p>

<p>GDPR states that it only concerns enterprises, and the possibility to be exempt when the company size is less than 250. However, it also describes this to be due to smaller companies posing a smaller risk.</p>

<blockquote>
  <p>To fall within the remit of the GDPR, the processing has to be part of an "enterprise". Article 4(18) of the Regulation defines this as any legal entity that's engaged in economic activity. You must be careful not to mistake business conducted from home for household activity.</p>
</blockquote>

<p>Does this mean that students/individuals who process potentially huge amounts of PII are exempt from GDPR compliance? Or does GDPR cover this in another way?</p>

<h3>Corrections to your statements or quotations</h3>

<p>Your quotation "To fall within the remit of the GDPR, the processing has to be part of an "enterprise" (...)" is not from the GDPR, and is an erroneous statement.</p>

<p>Also, the threshold of 250 employees you refer to, is only relevant with regards to the record-keeping obligations of <a href="https://gdpr-info.eu/art-30-gdpr/" rel="noreferrer">Article 30</a>.</p>

<h3>GDPR provisions relevant to your question</h3>

<p>The GDPR applies to individuals or students in accordance with the material scope of the GDPR, which is treated in <a href="https://gdpr-info.eu/art-2-gdpr/" rel="noreferrer">Article 2</a> (2) c) where GDPR states that "This Regulation does not apply to the processing of personal data: (...) by a natural person in the course of a purely personal or household activity;"</p>

<p>The <a href="https://gdpr-info.eu/recitals/no-18/" rel="noreferrer">Recital 18</a> of the GDPR gives some insight as to what would be a purely personal or household activity as follows:</p>

<blockquote>
  <p>(18) This Regulation does not apply to the processing of personal data
  by a natural person in the course of a purely personal or household
  activity and thus <strong>with no connection to a professional or commercial</strong>
  <strong>activity</strong>. Personal or household activities could include
  correspondence and the holding of addresses, or social networking and
  online activity undertaken within the context of such activities.
  However, this Regulation applies to controllers or processors which
  provide the means for processing personal data for such personal or
  household activities.</p>
</blockquote>

<h3>Interpretation</h3>

<p>To my knowledge, there are no specific guidelines regarding this matter to date from WP29. Those may be adopted in the future, or some requirements may already exist in local laws in one of the EU countries or from documentation available from local data protection authorities. If you are based in the EU, you could check this with your local data protection authority.</p>

<p>There is, however, case law from the European Court of Justice as pointed out by Free Radical, interpreting the scope of the "personal use exception" in Directive 95/46/EC (which provisions are similar to the GDPR in this matter).</p>

<p>If your hobby is not limited to your personal circle (yourself and the persons in your household), and thus if you plan to share the results of your data collection and processing with third parties (possibly teachers, other fellow students, or anybody else if you publish the results of your work) resulting from your "hobby" activity, you certainly would not fall in this exception to the scope. Case <a href="http://curia.europa.eu/juris/liste.jsf?num=C-101/01" rel="noreferrer">C-101/01</a> is an example of publication on the Internet made by an individual claiming to use its "freedom of expression to create internet pages in the course of a non-profit-making or leisure activity". The court clarified that:</p>

<blockquote>
  <p>exception must (...) be interpreted as relating only to activities
  which are carried out in the course of private or family life of
  individuals, which is clearly not the case with the processing of
  personal data consisting in publication on the internet so that those
  data are made accessible to an indefinite number of people</p>
</blockquote>

<p>Another, less optimistic interpretation from the examples given by the GDPR recitals, could derive from the spirit in which purely personal or household activity are to be understood. These examples actually refer to limited amounts of data and which are related to the individual itself (his own address book, his social networking activity, etc.), and creating limited risks relevant to the person herself and its contacts. In this view, there is a risk that a "hobby" in which you collect data about thousands of persons unrelated to you, could be considered as not being really purely personal.</p>

<p>Actually, an interpretation of case law <a href="http://curia.europa.eu/juris/liste.jsf?num=C-212/13" rel="noreferrer">C-212/13</a> from the European Court of Justice also mentioned by Free Radical could support this reasoning.</p>

<p>In this case, a video recording of people was stored from cameras installed by an individual on his family home for its own security purposes, but the cameras were also monitoring a public space. The court ruled that:</p>

<blockquote>
  <p>To the extent that video surveillance such as that at issue in the
  main proceedings covers, even partially, a public space and is
  accordingly directed outwards from the private setting of the person
  processing the data in that manner, it cannot be regarded as an
  activity which is a purely ‘personal or household’ activity (...)</p>
</blockquote>

<p>Extending this reasoning to your question, a "hobby" consisting of collecting "huge list of names, emails, zipcodes" unrelated to you could be regarded as "directed outwards from the private setting (...)".</p>

<h3>Conclusion</h3>

<p>As a hobbyist, or a student, if you can work on fake computer generated data and achieve the same results in your personal learning purposes you should definitely consider doing so.</p>

gdpr