3 ms·

Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time.

Some people may find that a valuable trade-off, because the alternative would be to permit their customers to demand that they rewrite their logs at any time. I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand).

jacquesm 9y ago
Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting. > I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand). That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out.
- eadmund 9y ago
  > That's why the recommendation is that you strip PII from your logs for everybody. The problem is that IP addresses — a fundamental requirement for an acceptable network logging system — are considered PII. If this were about things like names, dates of birth &c. then I'd be in full agreement. But considering an IP address personal information which must be deleted on demand is IMNSHO insane. > That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out. I'm just a guy, y'know? I'm not going to pretend that it would be easy or cheap for others to make the same decision. But it is easy & cheap for me.
  - jacquesm 9y ago
    For a network logging system yes. But for a commercial entity on the web: no. Beyond a class 'C' you're not going to get much mileage out of IP addresses, unless you're trying to track people without using cookies and that would be one very good reason why you should not be keeping those IP addresses in the first place. If you're an ISP that changes, in that case there is a retention requirement. But a regular business in the normal course of performing its expected activities has no business retaining IP addresses longer than necessary. If that to you is unacceptable because you want append-only logs that stretch back years then that's your choice. But if I had to choose between cutting off roughly half of my turnover because I didn't want to comply with the law or complying with the law and slightly re-arranging my logging then I'd happily pick the latter. So no need to delete on demand, simply don't store them longer than you feel you need to in order to meet your business goals. 30 days or so should do it. Six months or longer would require a detailed explanation. And most importantly: disclose what you do. That way your customers can make informed decisions and you won't look bad in the eyes of the law if they decide to decide on whether or not you meant to act in good faith or if you took to interpreting things in the way that suits you best.
redler 9y ago
Perhaps you could encrypt your logs after a predefined “live data” period passes. Each log line’s key would be derived from a key that is itself derived from the data subject’s unique identifier. If that subject invokes their “right to be forgotten” then the subject’s key is destroyed, rendering all thus-encrypted log lines irretrievable. This does mean analysis of “cold logs” would first require a potentially burdensome decryption process — but it would be possible, and the resulting logs would only contain data relating to permitted data subjects.

jacquesm 9y ago

Guess what? The EU agrees with you. That's why the recommendation is that you strip PII from your logs for everybody. That way they can still be append only and you won't have to do any rewriting. > I, personally, believe that logs should be fundamentally append-only, and thus will not be doing business with EU subjects (since the GDPR requires that I delete records from my logs on demand). That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out.

eadmund 9y ago
> That's why the recommendation is that you strip PII from your logs for everybody. The problem is that IP addresses — a fundamental requirement for an acceptable network logging system — are considered PII. If this were about things like names, dates of birth &c. then I'd be in full agreement. But considering an IP address personal information which must be deleted on demand is IMNSHO insane. > That statement does not hold a lot of force without a link to your business and how big a %age of your turnover you are willing to throw out. I'm just a guy, y'know? I'm not going to pretend that it would be easy or cheap for others to make the same decision. But it is easy & cheap for me.
- jacquesm 9y ago
  For a network logging system yes. But for a commercial entity on the web: no. Beyond a class 'C' you're not going to get much mileage out of IP addresses, unless you're trying to track people without using cookies and that would be one very good reason why you should not be keeping those IP addresses in the first place. If you're an ISP that changes, in that case there is a retention requirement. But a regular business in the normal course of performing its expected activities has no business retaining IP addresses longer than necessary. If that to you is unacceptable because you want append-only logs that stretch back years then that's your choice. But if I had to choose between cutting off roughly half of my turnover because I didn't want to comply with the law or complying with the law and slightly re-arranging my logging then I'd happily pick the latter. So no need to delete on demand, simply don't store them longer than you feel you need to in order to meet your business goals. 30 days or so should do it. Six months or longer would require a detailed explanation. And most importantly: disclose what you do. That way your customers can make informed decisions and you won't look bad in the eyes of the law if they decide to decide on whether or not you meant to act in good faith or if you took to interpreting things in the way that suits you best.

redler 9y ago

Perhaps you could encrypt your logs after a predefined “live data” period passes. Each log line’s key would be derived from a key that is itself derived from the data subject’s unique identifier. If that subject invokes their “right to be forgotten” then the subject’s key is destroyed, rendering all thus-encrypted log lines irretrievable. This does mean analysis of “cold logs” would first require a potentially burdensome decryption process — but it would be possible, and the resulting logs would only contain data relating to permitted data subjects.