5 ms·

Maybe I’m misunderstanding GDPR, can you explain how tracking your users through logs is OK within the GDPR, but Google Analytics isn’t Ok.

by jshen 9y ago

beberlei 9y ago
Logfiles are necessary to operate a service securely and guarantee quality of service. This is one form of implicit consent that users are giving you without you having to ask them for it. But Storing IP addresses for each access indefinitely (> some days) is the problem. If you rotate the files into a version where IP addresses are without the last part after a few days, then this is considered pseudonymous data and GDPR has no problem with you keeping this for a long time anymore.
- jshen 9y ago
  Local log files are not automatically compliant by my reading of the GDPR, but IANAL. My understanding is that PII is a huge risk, regardless of it being local or with a vendor, and you aren't allowed to track things that you aren't actively using for some business process. Many default log formats have data that people don't actively use, which seems to be a violation of GDPR even for local files. Again, IANAL.
danieldk 9y ago
IANAL, so this is not legal advise! First: I think it is ethically better, because you are not giving your user's data to a large company that builds profiles of your users for their own purposes. Second: if you pass the data to an analytics company, you share responsibility in ensuring that that data is processed according to the GDPR. Article 83 states on imposing/determining fines: the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them It is up to you (as the controller) to ensure that you use a data processor that is GDPR-compliant (Article 28): Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. (By the way, it seems from the same article that you also need a written contract with the data processor that specifies exactly what data is provided, for which period, etc.) --- tl;dr: it seems much easier to fulfil the obligations of the GDPR when you do not involve third parties.
- jshen 9y ago
  I still don't see how local files are by default compliant with the GDPR. I get that you prefer it from an ethical point of view, but that's unrelated to the specifics of the GDPR.

Maybe I’m misunderstanding GDPR, can you explain how tracking your users through logs is OK within the GDPR, but Google Analytics isn’t Ok.

by jshen 9y ago

Maybe I’m misunderstanding GDPR, can you explain how tracking your users through logs is OK within the GDPR, but Google Analytics isn’t Ok.

beberlei 9y ago

Logfiles are necessary to operate a service securely and guarantee quality of service. This is one form of implicit consent that users are giving you without you having to ask them for it. But Storing IP addresses for each access indefinitely (> some days) is the problem. If you rotate the files into a version where IP addresses are without the last part after a few days, then this is considered pseudonymous data and GDPR has no problem with you keeping this for a long time anymore.

jshen 9y ago
Local log files are not automatically compliant by my reading of the GDPR, but IANAL. My understanding is that PII is a huge risk, regardless of it being local or with a vendor, and you aren't allowed to track things that you aren't actively using for some business process. Many default log formats have data that people don't actively use, which seems to be a violation of GDPR even for local files. Again, IANAL.

danieldk 9y ago

IANAL, so this is not legal advise! First: I think it is ethically better, because you are not giving your user's data to a large company that builds profiles of your users for their own purposes. Second: if you pass the data to an analytics company, you share responsibility in ensuring that that data is processed according to the GDPR. Article 83 states on imposing/determining fines: the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them It is up to you (as the controller) to ensure that you use a data processor that is GDPR-compliant (Article 28): Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. (By the way, it seems from the same article that you also need a written contract with the data processor that specifies exactly what data is provided, for which period, etc.) --- tl;dr: it seems much easier to fulfil the obligations of the GDPR when you do not involve third parties.

jshen 9y ago
I still don't see how local files are by default compliant with the GDPR. I get that you prefer it from an ethical point of view, but that's unrelated to the specifics of the GDPR.