4 ms·

See GDPR recital 24 (http://www.privacy-regulation.eu/en/recital-24-GDPR.htm http://www.privacy-regulation.eu/en/recital-24-GDPR.htm): [...] In order to determ

by havkom 9y ago

See GDPR recital 24 (http://www.privacy-regulation.eu/en/recital-24-GDPR.htm http://www.privacy-regulation.eu/en/recital-24-GDPR.htm): [...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. It appears like monitoring is closely related to profiling, defined in Article 4 as: ‘profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements If you are trying to eg. predict preferences of data subjects by collecting the logs you are probably monitoring their behavior. If you are doing this it should be pretty clear to you from the purposes you are collecting information for. Security purposes (such as preventing DDoS attacks) are probably not purposes of monitoring data subjects behavior or profiling.

shkkmo 9y ago
Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back against the assertion: "I really don't think ... that anything in GDPR is hard to understand"
- havkom 9y ago
  Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“ If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most certainly in violation with this principle and therefor forbidden. A “lawful basis” for the marketing purpose will not save you from this principle. This is also where the public privacy policy/notice plays a role - for the company to be able to prove that the IP addresses where also originally collected for marketing purposes and fair information was given about this purpose at the point of collection. In terms of GDPR’s territorial scope I guess at the point in time you start to use the DDoS prevention IP logs for profiling you come into GDPR scope. You would also be immediately be in violation of the purpose limitation principle if it is for marketing purposes.
  - aeorgnoieang 9y ago
    > If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ... Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right? Someone would actually need to use the data, in some concrete specific way, for something illegal to have taken place. Right?
    - havkom 9y ago
      Yes
- havkom 9y ago
  And no, GDPR is from my own experience not easy to understand or apply in practice - except for PPT toy problems. There is a lot of more behind the articles in GDPR since it is partly based on legal instruments on data protection from 1981(!), “Convention 108” and EU legislation from 1995. Case law, opinions from data protection authorities etc. are important. In general though, I would not be worried about big fines or anything as long as you try to follow GDPR and you are not doing things the data subjects does not want you to do with their data. In general, the best GDPR compliance test is how it feels in your gut, after learning the principles. At the point in time you process personal data against the interests of the data subject (for example building marketing profiles, sharing data with third parties w/o request from the data subject, etc) it is time to start worrying and make sure you cross the i’s... GDPR is pretty permissive in general IMO but make sure you know the details.
tatersolid 9y ago
Predicting and profiling for the purposes of security defense is then illegal? It’s not a legitimate interest? Then every system implementing fail2ban or email tarpitting (so everyone running Ubuntu or MS exchange in default configs) is automatically violating GDPR. Never mind the built-in catch-22 where you can’t store any identifiers of persons who have opted out, so you cannot remember they opted out and have to ask them repeatedly! This law is completely unenforceable, and that is the worst kind of law. It results in inconsistent, politicized and malicious enforcement.

by havkom 9y ago

shkkmo 9y ago

Thanks for the link. > potential subsequent use of personal data processing techniques Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage? Even if you aren't actually doing or intending to do any profiling, the potential still exists. You may well be correct about all this (and I suspect you are). I'm specifically trying to push back against the assertion: "I really don't think ... that anything in GDPR is hard to understand"

havkom 9y ago
Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b): “Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“ If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most certainly in violation with this principle and therefor forbidden. A “lawful basis” for the marketing purpose will not save you from this principle. This is also where the public privacy policy/notice plays a role - for the company to be able to prove that the IP addresses where also originally collected for marketing purposes and fair information was given about this purpose at the point of collection. In terms of GDPR’s territorial scope I guess at the point in time you start to use the DDoS prevention IP logs for profiling you come into GDPR scope. You would also be immediately be in violation of the purpose limitation principle if it is for marketing purposes.
- aeorgnoieang 9y ago
  > If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ... Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right? Someone would actually need to use the data, in some concrete specific way, for something illegal to have taken place. Right?
  - havkom 9y ago
    Yes
havkom 9y ago
And no, GDPR is from my own experience not easy to understand or apply in practice - except for PPT toy problems. There is a lot of more behind the articles in GDPR since it is partly based on legal instruments on data protection from 1981(!), “Convention 108” and EU legislation from 1995. Case law, opinions from data protection authorities etc. are important. In general though, I would not be worried about big fines or anything as long as you try to follow GDPR and you are not doing things the data subjects does not want you to do with their data. In general, the best GDPR compliance test is how it feels in your gut, after learning the principles. At the point in time you process personal data against the interests of the data subject (for example building marketing profiles, sharing data with third parties w/o request from the data subject, etc) it is time to start worrying and make sure you cross the i’s... GDPR is pretty permissive in general IMO but make sure you know the details.

tatersolid 9y ago

Predicting and profiling for the purposes of security defense is then illegal? It’s not a legitimate interest? Then every system implementing fail2ban or email tarpitting (so everyone running Ubuntu or MS exchange in default configs) is automatically violating GDPR. Never mind the built-in catch-22 where you can’t store any identifiers of persons who have opted out, so you cannot remember they opted out and have to ask them repeatedly! This law is completely unenforceable, and that is the worst kind of law. It results in inconsistent, politicized and malicious enforcement.