9 ms·
Logfiles are necessary to operate a service securely and guarantee quality of service. This is one form of implicit consent that users are giving you without yo
by beberlei 9y ago
Logfiles are necessary to operate a service securely and guarantee quality of service. This is one form of implicit consent that users are giving you without you having to ask them for it.
But Storing IP addresses for each access indefinitely (> some days) is the problem.
If you rotate the files into a version where IP addresses are without the last part after a few days, then this is considered pseudonymous data and GDPR has no problem with you keeping this for a long time anymore.
- jshen 9y agoLocal log files are not automatically compliant by my reading of the GDPR, but IANAL. My understanding is that PII is a huge risk, regardless of it being local or with a vendor, and you aren't allowed to track things that you aren't actively using for some business process. Many default log formats have data that people don't actively use, which seems to be a violation of GDPR even for local files. Again, IANAL.