Background

A normal website can usually only display text, forms, images and videos and link between different pages. With the help of external services, however, additional functions can be offered on the website, such as a journey planner, social media elements or booking functions. External services are also used to analyse the type and number of website visits. These are often referred to as "plugins". 

If you integrate external services into your website, check which personal data the service processes and whether and where the service transmits data to. You must also provide information about this processing in the data protection information.

Duty to inform and consent

Let's take a YouTube video that is integrated into our website as an example. When our website is accessed, the server first loads the content of our own website and then accesses the YouTube server to load the corresponding video from there. The IP address of the website visitor is also transmitted to YouTube, which means that personal data is transmitted to a third-party provider - in this case even to a provider outside the EU. 

Furthermore, as the operator of the website, you require a legal basis for the transfer of data. As there is no compelling reason to display a YouTube video, the only remaining option is processing based on consent. This consent must be given before the data is transferred to the third-party provider. There are various technical solutions for this. Often, instead of the external content, a notice is first displayed in which the website visitor gives their consent to view the content. 

Cookies

Cookies are small text files on our computer in which a website can store data. With the help of cookies, our surfing behaviour can be tracked across several websites, for example, so that we can be shown personalised advertising. Tracking surfing behaviour on the internet is also known as "tracking". 

When you open a website, you will often see a so-called "cookie banner". This is a small to medium-sized message window in which we are informed about the data processing and can give our consent to the processing. The option of not giving consent is often cleverly hidden in these banners, as many websites use this data to finance themselves by displaying personalised advertising.  

Your website will probably not collect any such data, but cookies are sometimes required for technical purposes. You should therefore have your website checked by a person from the relevant specialist department or the external service provider that manages the website to see whether such data is processed in the background. Then add to your data protection information if necessary.

For those interested in technology

The Firefox browser plugin "uMatrix" allows you to visualise various website activities. For example, you can also see whether and which cookies a website uses: https://addons.mozilla.org/en-US/firefox/addon/umatrix/