3 ms·

> What happens if they get a law enforcement request with warrant/subpoena? I bet the data is there to be delivered. If they aren't _very_ intentional about scr

> What happens if they get a law enforcement request with warrant/subpoena? I bet the data is there to be delivered. If they aren't _very_ intentional about scrubbing it, it's maybe there in some historical logs too. Under current German and EU law, they can only keep logs as long as technically necessary. If a warrant, specific to me, personally, exists, they can collect future connection info. And I’m okay with that – requiring a warrant specifically to be written for me, specifically signed by a judge, and in a way that they can’t be rubberstamped is okay, and about the level of surveillance that is a reasonable tradeoff.

jrochkind1 9y ago
Have you ever actually audited exactly what logs your enterprise is keeping? Most people haven't. The law notwithstanding, minimizing personally identifiable information in logs actually requires intentional and positive action (meaning additional hours/expense). If you just let all your systems produce what logs they do by default, get backed up if they happen to get backed up, etc. -- you will have quite a bit more logging bits sitting around than you probably realized or intended or needed. Is it more than is "technically necessary"? I am not sure what that phrase means legally or practically. But I doubt that law has actually resulted in companies spending significant additional staff time minimizing logs they didn't really mean to be keeping int the first place. It is not a trivial operation.
- kuschku 9y ago
  > But I doubt that law has actually resulted in companies spending significant additional staff time minimizing logs they didn't really mean to be keeping int the first place. It is not a trivial operation. This is Germany – the place where the requirement for websites to contain a working contact address in the real world is enforced not through law, but through people just suing every website owner whose site doesn’t have an imprint. The ISP is only keeping as much as absolutely necessary, because every bit more would be an unnecessary legal liability. Personal data is a liability, not an asset. Of course, there’s also companies with different viewpoints, but this one doesn’t keep any more than absolutely necessary.

jrochkind1 9y ago

Have you ever actually audited exactly what logs your enterprise is keeping? Most people haven't. The law notwithstanding, minimizing personally identifiable information in logs actually requires intentional and positive action (meaning additional hours/expense). If you just let all your systems produce what logs they do by default, get backed up if they happen to get backed up, etc. -- you will have quite a bit more logging bits sitting around than you probably realized or intended or needed. Is it more than is "technically necessary"? I am not sure what that phrase means legally or practically. But I doubt that law has actually resulted in companies spending significant additional staff time minimizing logs they didn't really mean to be keeping int the first place. It is not a trivial operation.

kuschku 9y ago
> But I doubt that law has actually resulted in companies spending significant additional staff time minimizing logs they didn't really mean to be keeping int the first place. It is not a trivial operation. This is Germany – the place where the requirement for websites to contain a working contact address in the real world is enforced not through law, but through people just suing every website owner whose site doesn’t have an imprint. The ISP is only keeping as much as absolutely necessary, because every bit more would be an unnecessary legal liability. Personal data is a liability, not an asset. Of course, there’s also companies with different viewpoints, but this one doesn’t keep any more than absolutely necessary.