GDPR compliance - lawful basis for transfer to third country

[tdelmas]

@aarongable

I think the discussion OCSP in this thread is a red herring

It is not.

@aarongable

all inter-continental web requests would do the same)

They are. (Edit: they most probably are, in my opinion)

@aarongable

it would be a browser transferring that data

As for any other data transfer. It's not a "workaround". The visit to the website, because of how it was built/configured, did produce that transfer

@aarongable

As others have said, the only pieces of data which are transmitted to Let's Encrypt are:

• One or more domain names
• One public key
• Optionally, an email address

I cannot tell you whether any or all of those constitute "personal data" as defined by GDPR Article 4 (1).

And the IP address. And as the IP may identify an individual, that information and all linked information (so, the certificate for example) are personal data. (Edit: they most probably are, in my opinion)

Edit: to clarify, I am NOT a lawyer, and I am speaking here only as an individual, and this is my personal opinion.