4 ms·

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balanc

by havkom 9y ago

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Do: - Make a link to a privacy policy clearly accessible (eg on your website footer) and make sure it contains all of the required elements of information (see Article 13) - Do not store the data longer than reasonable - Do not worry too much about logs/backups etc as long as what you do is reasonable and you do have a reasonable delete schedule - no lawyers I have met seems to worry about this. - Worry instead about for what purposes you actually use data you collect (what other orgs do you share data with, why, what do you do with the data that produces an effect on the data subject (eg marketing) etc)

shkkmo 9y ago
> Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Assuming you are right, that answers part of my question. Yet, I would prefer to see this detailed by an official source. The other part of my question still remains unanswered. The GDPR limits who qualifies as providing goods/services, but I don't see any limitation on who qualifies under "the monitoring of their behaviour as far as their behaviour takes place within the Union." It seems like this create a legal liability for every single website with an access log unless it displays a privacy policy.
- havkom 9y ago
  See GDPR recital 24 (http://www.privacy-regulation.eu/en/recital-24-GDPR.htm http://www.privacy-regulation.eu/en/recital-24-GDPR.htm): [...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. It appears like monitoring is closely related to profiling, defined in Article 4 as: ‘profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements If you are trying to eg. predict preferences of data subjects by collecting the logs you are probably monitoring their behavior. If you are doing this it should be pretty clear to you from the purposes you are collecting information for. Security purposes (such as preventing DDoS attacks) are probably not purposes of monitoring data subjects behavior or profiling.
  - shkkmo 9y ago
    Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back against the assertion: "I really don't think ... that anything in GDPR is hard to understand"
    - havkom 9y ago
      Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“ If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most certainly in violation with this principle and therefor forbidden. A “lawful basis” for the marketing purpose will not save you from this principle. This is also where the public privacy policy/notice plays a role - for the company to be able to prove that the IP addresses where also originally collected for marketing purposes and fair information was given about this purpose at the point of collection. In terms of GDPR’s territorial scope I guess at the point in time you start to use the DDoS prevention IP logs for profiling you come into GDPR scope. You would also be immediately be in violation of the purpose limitation principle if it is for marketing purposes.
      - aeorgnoieang 9y ago
        > If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ... Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right? Someone would actually need to use the data, in some concrete specific way, for something illegal to have taken place. Right?
77pt77 9y ago
> Sounds like you have a legitimate interest in logging IP addresses for security purposes European legislation demands this in fact. You have to keep the logs for a few months.
- Silhouette 9y ago
  What European legislation is that?
  - 77pt77 9y ago
    https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive Apparently no longer in effect (overthrown)
    - Silhouette 9y ago
      Yes, it was. Also, in case it wasn't clear, that rule only applied to communications services, not your average website.
      - 77pt77 9y ago
        Anyone running a webmail service for example was subject to it. Same thing for IRC or xmpp servers It was actually quite broad.

by havkom 9y ago

shkkmo 9y ago

> Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Assuming you are right, that answers part of my question. Yet, I would prefer to see this detailed by an official source. The other part of my question still remains unanswered. The GDPR limits who qualifies as providing goods/services, but I don't see any limitation on who qualifies under "the monitoring of their behaviour as far as their behaviour takes place within the Union." It seems like this create a legal liability for every single website with an access log unless it displays a privacy policy.

havkom 9y ago
See GDPR recital 24 (http://www.privacy-regulation.eu/en/recital-24-GDPR.htm http://www.privacy-regulation.eu/en/recital-24-GDPR.htm): [...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. It appears like monitoring is closely related to profiling, defined in Article 4 as: ‘profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements If you are trying to eg. predict preferences of data subjects by collecting the logs you are probably monitoring their behavior. If you are doing this it should be pretty clear to you from the purposes you are collecting information for. Security purposes (such as preventing DDoS attacks) are probably not purposes of monitoring data subjects behavior or profiling.
- shkkmo 9y ago
  Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back against the assertion: "I really don't think ... that anything in GDPR is hard to understand"
  - havkom 9y ago
    Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“ If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most certainly in violation with this principle and therefor forbidden. A “lawful basis” for the marketing purpose will not save you from this principle. This is also where the public privacy policy/notice plays a role - for the company to be able to prove that the IP addresses where also originally collected for marketing purposes and fair information was given about this purpose at the point of collection. In terms of GDPR’s territorial scope I guess at the point in time you start to use the DDoS prevention IP logs for profiling you come into GDPR scope. You would also be immediately be in violation of the purpose limitation principle if it is for marketing purposes.
    - aeorgnoieang 9y ago
      > If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ... Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right? Someone would actually need to use the data, in some concrete specific way, for something illegal to have taken place. Right?

77pt77 9y ago

> Sounds like you have a legitimate interest in logging IP addresses for security purposes European legislation demands this in fact. You have to keep the logs for a few months.

Silhouette 9y ago
What European legislation is that?
- 77pt77 9y ago
  https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive Apparently no longer in effect (overthrown)
  - Silhouette 9y ago
    Yes, it was. Also, in case it wasn't clear, that rule only applied to communications services, not your average website.
    - 77pt77 9y ago
      Anyone running a webmail service for example was subject to it. Same thing for IRC or xmpp servers It was actually quite broad.