Law note · European Union
General Data Protection Regulation (GDPR), Comprehensive Regime
Establishes the lawful basis, purpose limitation, and controller and processor accountability framework for processing personal data of people in the EU. Article 6(1) requires one of six lawful bases for any processing, Articles 24-28 allocate duties between controllers, joint controllers and processors, and the Regulation applies extraterritorially to any controller or processor offering goods or services to, or monitoring, people in the EU (Article 3).
It binds public authorities as well as private sector controllers, though Article 83(7) lets Member States decide whether administrative fines apply to their own public bodies.
What it asks of an app
- Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
- Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, and appoint a Data Protection Officer where your core activities involve large scale monitoring or large scale special category processing.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679