3 ms·

It's not the IP address that's the problem, it's that they're processing personally identifiable information about their users in a way they haven't asked permi

It's not the IP address that's the problem, it's that they're processing personally identifiable information about their users in a way they haven't asked permission for and is not related to the service they're providing. Here's the UK's ICO guidance for what you can process, as far as I can tell they've got no lawful basis for trying to match a user's IP address to a company without the user asking them to. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

andrewem 9y ago
I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning of a word isn't necessarily what is meant.) Do you understand what they mean by "processing" in this context? It seems like you're saying that analyzing IP addresses a user connected from in order to determine their likely employer is against the UK's GDPR guidance, even if the data is released only in aggregate (but that it might be fine to keep that IP data since perhaps there are other uses for it which would be legitimate). Is that your understanding?
- teget 9y ago
  Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law: > (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (Directive 95/46/EC) All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss). [1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lang1=de&type=TXT&ancre= http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...
- mattmanser 9y ago
  It's not about what you release to the public, if you're processing this data in private it's still culpable. This page gives it some context: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Further down are the 6 reasons for processing. We know the first 5 don't apply: consent - there's no consent contract - it's not necessary to provide the Q&A answer site Legal obligation - there's no legal obligation Vital interests - nope Public task - nope So what it falls under is "Legitimate interests", SO want to use a user's IP address, process it to add company name, store that and then use that data for profiling their customers to serve them ads. One of the problems for SO is that further down they go into this a bit more and there's a few key questions: Would individuals expect this processing to take place? Are some of the individuals concerned likely to object? Are you able to stop the processing at any time on request? Which I would think would be answer No, Yes, No. Which seems to indicate that there's some problems with SO's approach.
gwright 9y ago
In skimming through the StackOverflow privacy statement it certainly appears that they disclose the collection of IP addresses and use of that information to report aggregated data ("we may publicly display information that is not personally identifying in the aggregate").

andrewem 9y ago

I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning of a word isn't necessarily what is meant.) Do you understand what they mean by "processing" in this context? It seems like you're saying that analyzing IP addresses a user connected from in order to determine their likely employer is against the UK's GDPR guidance, even if the data is released only in aggregate (but that it might be fine to keep that IP data since perhaps there are other uses for it which would be legitimate). Is that your understanding?

teget 9y ago
Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law: > (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (Directive 95/46/EC) All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss). [1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lang1=de&type=TXT&ancre= http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...
mattmanser 9y ago
It's not about what you release to the public, if you're processing this data in private it's still culpable. This page gives it some context: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Further down are the 6 reasons for processing. We know the first 5 don't apply: consent - there's no consent contract - it's not necessary to provide the Q&A answer site Legal obligation - there's no legal obligation Vital interests - nope Public task - nope So what it falls under is "Legitimate interests", SO want to use a user's IP address, process it to add company name, store that and then use that data for profiling their customers to serve them ads. One of the problems for SO is that further down they go into this a bit more and there's a few key questions: Would individuals expect this processing to take place? Are some of the individuals concerned likely to object? Are you able to stop the processing at any time on request? Which I would think would be answer No, Yes, No. Which seems to indicate that there's some problems with SO's approach.

gwright 9y ago

In skimming through the StackOverflow privacy statement it certainly appears that they disclose the collection of IP addresses and use of that information to report aggregated data ("we may publicly display information that is not personally identifying in the aggregate").