Open Source Community Unites to Build EU CRA-Compliant Cybersecurity Processes

https://berthub.eu/articles/posts/eu-cra-what-does-it-mean-f...

It depends on your scale. Suppose I ran a small website that provided news and articles and forums about some small hobby that I am into. Maybe 100 users worldwide. I include articles about European things related to that hobby, written specifically to better serve the European visitors to my site.

The only personal information I store is IP addresses in my Apache logs.

Such a site could be run for less than $100/year in hosting costs.

If my processing of personal information counts as "occasional" then as far as I can tell GDPR imposes no burden on me, other than having to deal with it when someone requests that I remove their personal information.

If my processing does not count as "occasional" then under Article 27 I would need to appoint a representative in the Union that people and regulators could contact when they have GDPR related matters involving me.

There are companies that provide "in-Union GDPR representative as a service" but the least expensive I've seen is around €100. If I had to use such a service I'd be at least doubling my costs which would probably push the costs past what I'd be willing to do for a hobby site that is not monetized.

Would my processing be "occasional"? The recital for Article 27 doesn't provide any guidance on what "occasional" means.

One the one hand one might argue that a low traffic site is almost by definition "occasional" in everything it does. On the other hand one might argue that my site is processing IP addresses on every single request it processes and that something that happens 100% of the time surely can't be "occasional".

At some point this issue will arise and the GDPR regulators in some member state will issue a ruling that clarifies it, and if we are lucky no other member state's regulators will issue a ruling that goes the other way.

Even if it is eventually decided that processing such as mine is definitely "occasional" the fact that I have to think about it in the first place is somewhat burdensome.

That is not what I am suggesting. I am wondering about ways to not allow people to redistribute in ways that increases your liability. i.e. the law would apply, but the people using it in the way that exposes you to liability would be in breach of copyright.

Sadly, looking more closely at the wording, this cannot be done in a GPL comaptible way. maybe we need new licenses to cover this.

> but as others said this will (arguably) only apply to real commercial activy

Aguably? maybe, but we need certainty. It does look as though a lot of smaller projects and developers will be at risk here if (for example) they dual license with a paid for version available, or sell support of consultancy services.

Article 27 is about requiring that you at least support one specific method of contact: a representative in the Union. It applies if your site is covered by GDPR and is not in the Union.

There's an exception for sites whose processing of personal data is occasional, does not include certain particularly sensitive kinds of data (e.g., genetic data, health data, criminal conviction records), and is unlikely to pose a risk to the rights and freedoms of natural persons.

There's some commentary here [1] about Article 27. It says that

> The aim of Article 27 GDPR is to ensure that the level of protection afforded to EU-based data subjects is not reduced where non-EU based controllers or processors process their data. It aims to both provide a contact point for data subjects and ensure that there is legal accountability for processing activities by mandating the appointment of a representative.

I see that page also has something to say about what "occasional" mean:

> The term "occasional" has been interpreted by the WP29 to mean processing that is not carried out regularly and that falls outside of the scope of the regular activities of the controller or processor. Similarly, Millard and Kamarinou have interpreted the term "occasional" to mean "non-systematic" processing, or in other words, processing that happens on an ad hoc and infrequent basis and not in a regular way

It sounds like automatically logging all visits to your web server in the Apache logs would not be "occasional".

[1] https://gdprhub.eu/Article_27_GDPR