Re-read that link at #3. Here's the key bit.

"its core activities involve processing of sensitive data on a large scale ---> OR <--- involve large scale, regular and systematic monitoring of individuals"

Any analytics provider is fundamentally doing "large scale, regular and systematic monitoring of individuals".

I was hoping to find something like this mentioned in here. I’ve worked on a tracking tool that I don’t think does tracking of “individuals”. Instead I’m collecting stats about the site and impressions on its pages. It’s actually very, very simple. I am not tracking visitors and I don’t log IP addresses. It doesn’t set any cookies or anything else in the browser.

I built this to track my own sites but I am curious if anyone else cares. I created a landing page to see if there’s any interest.

https://protectivemetrics.com

The product is working on a few sites of my own and is hosted on a raspberry pi in my home office. I’d need to do some work to make it available for others, but I don’t want to invest more into it unless there’s any interest.

Heads up your site has a grey background and white text when using system dark mode on Firefox mobile.

Yes, you are right that there is another part of the definition about large scale, regular and "systematic monitoring" of individuals. Apologies for not including that in the answer above.

Quoting from WP 243 Annex provided by the EU:

"The notion of regular and systematic monitoring of data subjects is not defined in the GDPR, but clearly includes all forms of tracking and profiling on the internet, including for the purposes of behavioural advertising. However, the notion of monitoring is not restricted to the online environment."

The link is here

https://ec.europa.eu/information_society/newsroom/image/docu...

We anonymize and aggregate all data so can't track or profile any users, or do such monitoring offline.

Off topic: This comment reads so much like a message in ChatGPT conversation :D

1. My apologies. I as looking at the link from WordPress. Right. As UK entity you are good.

2. Your subprocessor uses AWS. No way to stay compliant if you transmit visitor IP to US cloud (even if they use European servers).

3. Sadly, wrong. You should immediately consult privacy professional. DPO is necessary. There are 3 tests.

https://ico.org.uk/for-organisations/does-my-organisation-ne...

Answer to question 2 is yes btw.

You are not compliant without DPO and because you are using AWS, even if indirectly.

Thank you for your follow up.

1. Glad we're in agreement!

2. We agree it is not GDPR compliant to transmit IP address data to the US. This is why we salt and hash all PII data so no IP address data is sent to the US. Please see our data policy.

https://beamanalytics.io/data

3. Thank you for your suggestion. We have already consulted privacy professionals and have been assured no DPO is required.

Thank you for this conversation about GDPR. We appreciate your interest in Beam's work.

>salt and hash all PII data

Can you share more detail on this? On this page[1], I see this:

  hash(pepper(salt(ip address + user agent data))) = anonymized hashed data

Both the ipv4 space and typical user agent possibilities are pretty small, so it feels like you could easily de-anonymize it when you want to. That is, assuming the "salt" and "pepper" are stored somewhere. I assume you do store them, otherwise it's not helpful to identify repeat visits.

[1] https://beamanalytics.io/data

Are you saying there is no way to use AWS and be GDPR compliant? Or the way that OP is using AWS isn't GDPR compliant?

There is a way to use AWS assuming you can assure no Personal Data is processed in plain text on AWS.

There was a case of Doctolib in the EU. French authority investigated Doctlib for using AWS.

They got off the hook because data was encrypted in the EU, outside of AWS and the encryption keys were inaccessible to AWS.

Similarly Sendinblue uses GCP and AWS as dumb storage of externally encrypted backups.

There are valid use cases. But these are very limited.

Aula - a system used for communication between parents and schools in Denmark - is using AWS. They use encryption and ensures that only European datacenters are used. Source (in Danish): https://aulainfo.dk/guide-til-projektledere/sikkerhed-i-aula...

IANAL but as I understand it there is, currently, no way to legally use a service for personal data handling that falls under the US CLOUD act.

In theory Amazon could license their brand and software to an independent (!) European company to offer a EU-AWS.

Basically if an American judge/agency can order Amazon to hand over European private data and they have the ability to comply without involving a European court the service is not GDPR compliment.

Now in practice this isn't how things are done but to the best of my knowledge the law hasn't changed (yet) and national dpas are starting to tighten the screws (slowly).

If I recall correctly there are EU-US talks to create Privacy Shield #3.

> I think the European Commission did indicate that the UK was an Adequate Country?

Every so often I see something like this:

https://www.mayerbrown.com/en/perspectives-events/publicatio...

I suspect the UK is planning a number of changes that may change this, so even though I'm British, for the avoidance of doubt I prefer companies actually hosted in the EU and that will agree to conduct business in Europe (and thus under EU courts, rather than GB ones).

> 3. On the Data Protection Officer, I think one is only needed if sensitive data on a large scale is processed.

You are totally incorrect about that.

https://ico.org.uk/for-organisations/guide-to-data-protectio...