Do web applications as hobby projects need to comply with the GDPR?
<p>I would like to know if you must comply with the General Data Protection Regulation, if you've made a web application that is not subject to any business or organisation.</p>

<blockquote>
  <p>2) This Regulation does not apply to the processing of personal data:
  in the course of an activity which falls outside the scope of Union law;
  by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;
  by a natural person in the course of a purely personal or household activity;
  by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.</p>
</blockquote>

<p>From Article 2 of the GDPR (<a href="https://gdpr-info.eu" rel="nofollow noreferrer">https://gdpr-info.eu</a>)</p>

<ul>
<li>Does this mean I don't need to comply with the GDPR if I'm not an organisation?
<br></li>
<li>If I was an organisation, how simple it would be to comply with this law, to avoid civil liabilities?</li>
</ul>

<p>As always, it depends.</p>

<p>However, it is by no means <em>certain</em> that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR.</p>

<p>Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet.</p>

<p>However, when considering this, one should take the following two facts into consideration.</p>

<p><strong>1. The "personal use exeption" in the GDPR is not <em>new</em>.</strong></p>

<p>The personal use exemption is <em>unchanged</em> from the article 3(2) of <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046&amp;from=EN" rel="nofollow noreferrer">Directive 95/46/EC</a>. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.)</p>

<p><strong>2. Case-law under the <em>previous</em> regulation restricts the scope of the exception</strong></p>

<p>The ECJ has ruled on the scope of the personal use exception in two cases:</p>

<ul>
<li><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=48382&amp;pageIndex=0&amp;doclang=en&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=322419" rel="nofollow noreferrer">C-101/01</a></li>
<li><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=160561&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=322511" rel="nofollow noreferrer">C-212/13</a></li>
</ul>

<p>In both these cases, the ECJ took an extremely <em>restrictive</em> view, and concluded that the personal use exemption did <em>not</em> apply to the processing done by these individuals.  In C-101/01 it can be argued that the hobby project as a blogger was <em>connected</em> to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there <em>no</em> such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did <em>not</em> apply.</p>

<p><strong>Discussion</strong></p>

<p>Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR.</p>

<p>However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just <em>because</em> what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR.</p>

<p><strong>Conclusion</strong></p>

<p>IMHO, you <em>may</em> be exempt, or you <em>may not</em> be exempt.  I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.</p>

<p><a href="https://gdpr-info.eu/recitals/no-18/" rel="nofollow noreferrer">Recital 18</a> gives some more details on that:</p>

<blockquote>
  <p>This Regulation does not apply to the processing of personal data by a
  natural person in the course of a purely personal or household
  activity and thus with no connection to a professional or commercial
  activity. Personal or household activities could include
  correspondence and the holding of addresses, or social networking and
  online activity undertaken within the context of such activities.</p>
</blockquote>

<p>So what matters is whether your activity is professional/commercial or not (you do not necessarily need to be an organisation to do business). If your web applications do not sell goods/services or otherwise create business-customer relationships — feel free to ignore GDPR.</p>

gdpr website