6 ms·

The problem is that pretty much everything seems to be considered personally identifiable data. Any web community will at least be storing usernames, passwords,

The problem is that pretty much everything seems to be considered personally identifiable data. Any web community will at least be storing usernames, passwords, emails and most likely IP addresses. As far as I know, all of that counts. And even if you don't have a login system, your web server is still going to be logging people's IP addresses.

lucideer 9y ago
Passwords are not personal data, and even if they were, you aren't storing them anyway (right?). There's a tricky question around usernames: they're technically not personal data since they aren't necessarily the real name of the user, but the user can choose to use their real name as their username, which is not easy to distinguish in any automated way. You don't need to store IPs
- tyfon 9y ago
  If someone makes a real name username and you don't do anything else about it, you should be fine. However, if you take that username, look up the user in the real world and send spam without consent you are in deep shit. It's all about consent of use and for what. The user has implicitly given consent to use their username as a username but nothing else.
tscs37 9y ago
Your webserver logging IP addresses is a legitimate interest that does not require consent (preventing abuse). I do hope you're not storing passwords, only a securely stretched and hashed variant, which is not subject to the GDPR. Emails and Usernames will require consent, as do IPs stored outside a context of legitimate interest (preventing abuse). The only thing that most communities will be missing is a function to delete all user data from their website (ie, delete user + all posts on request) but that should come into standard software soon enough or is already present.
CM30 9y ago
The point about IP addresses and emails makes me wonder what would happen to spammer blacklists. If they're personal information, does that mean services like Stop Forum Spam and Akismet need to remove data when requested, even if it makes life harder for forum admins and community managers? What about those topics you see on admin forums where you're given a giant list of IPs and emails to copy into the ban settings page?
- jimnotgym 9y ago
  A blacklist is a legitimate interest isn't it?
- tscs37 9y ago
  Preventing abuse is a legimitate interest to keep data even if deletion is requested. For the same reason users can't request you delete all copies of bills and receipts on them.
- r3bl 9y ago
  > where you're given a giant list of IPs and emails to copy into the ban settings page? If you're behind HN, and I email you and tell you to delete CM30's profile, would you do it or would you request me to prove ownership of the profile? If you're behind HN, and I email you asking you to delete thousands of accounts, would you just do it or would you request me to prove ownership of those 1000 profiles? Point being: You're not gonna delete anything until you have verified that the user is really who he is claiming to be.
geocar 9y ago
You're allowed to log people's IP addresses for diagnostic reasons, to prevent fraud and abuse. You don't have to delete these logs when someone emails you if they're still useful for those purposes. You do need to delete those logs eventually though, and you need to disclose how often that is. It can be ten years if you want. If you're not using IP addresses for those reasons, you shouldn't collect it. It is good advice to mask off the bottom bits of the IP address since it will still likely be unique enough for you, without being useful to someone who has an unrelated list of IP addresses. You should probably be doing that anyway: If you get hacked, you're basically giving your attacker a list of targets. You should be able to delete usernames, passwords and email addresses on request. You should be able to remember that request if you restore from backups. You should not be storing passwords since that puts your users at risk if you get hacked, and you're responsible for keeping their personal data safe.
- Silhouette 9y ago
  You don't have to delete these logs when someone emails you if they're still useful for those purposes. You do need to delete those logs eventually though, and you need to disclose how often that is. It can be ten years if you want. That sort of argument has worked pretty well for Disney and friends when it comes to extending copyright indefinitely and yet not technically violating the US constitution's "temporary" wording. I wonder how well it will work in this case. How can anyone possibly make a reasonable, intelligent, a priori assessment of how long that data will be useful for that kind of purpose? It is good advice to mask off the bottom bits of the IP address since it will still likely be unique enough for you, without being useful to someone who has an unrelated list of IP addresses. That isn't necessarily true if, for example, you're using IP addresses to detect a pattern of abusive access within a general pool of acceptable access. And if a full IP address isn't enough to potentially identify a specific threat, it surely also isn't enough to constitute personal data. Either way, your advice seems excessively broad here. You should be able to delete usernames, passwords and email addresses on request. You should be able to remember that request if you restore from backups. Doing this effectively without immediately becoming self-contradictory probably requires something like storing a hash of every user name or email address that has had deletion requested, and querying a database of such hashes during the restoration process in order to exclude affected data. While this may well be in the spirit of the GDPR, there is no denying that it is extremely onerous, particularly for anyone working with personal data who rarely if ever receives such a request yet would have to redesign a large part of their IT infrastructure around the ability to do it.
jimnotgym 9y ago
Usernames are not necessarilly personally identifying, and are freely given by the user to be publicly displayed on a forum. Passwords are not personnally indentifying, and you shouldn't be storing them anyway!
- majewsky 9y ago
  > Usernames are not necessarily personally identifying Literally the only purpose of usernames is identifying people. I don't know the actual text of the GDPR, so I don't know the definition of "personally identifying", but I find it very strange that people seem to restrict the definition of "personally identifying" to "connects directly to your IRL identity".
  - grabeh 9y ago
    The distinction stems partly from the US-EU divide. US use the term personally identifiable information (PII). This has a narrow definition and relates to that which connects your real identify. However, 'PII' is not a concept under EU data protection law which instead uses the far broader term of personal data. Personal data is both PII and any information which could be used to identify someone when combined with other information. As you suggest, a username is likely to be personal data because in lots of cases it is used as a unique ID and is used by the same person across multiple sites to identify them.

lucideer 9y ago

Passwords are not personal data, and even if they were, you aren't storing them anyway (right?). There's a tricky question around usernames: they're technically not personal data since they aren't necessarily the real name of the user, but the user can choose to use their real name as their username, which is not easy to distinguish in any automated way. You don't need to store IPs

tyfon 9y ago
If someone makes a real name username and you don't do anything else about it, you should be fine. However, if you take that username, look up the user in the real world and send spam without consent you are in deep shit. It's all about consent of use and for what. The user has implicitly given consent to use their username as a username but nothing else.

tscs37 9y ago

Your webserver logging IP addresses is a legitimate interest that does not require consent (preventing abuse). I do hope you're not storing passwords, only a securely stretched and hashed variant, which is not subject to the GDPR. Emails and Usernames will require consent, as do IPs stored outside a context of legitimate interest (preventing abuse). The only thing that most communities will be missing is a function to delete all user data from their website (ie, delete user + all posts on request) but that should come into standard software soon enough or is already present.

CM30 9y ago

The point about IP addresses and emails makes me wonder what would happen to spammer blacklists. If they're personal information, does that mean services like Stop Forum Spam and Akismet need to remove data when requested, even if it makes life harder for forum admins and community managers? What about those topics you see on admin forums where you're given a giant list of IPs and emails to copy into the ban settings page?

jimnotgym 9y ago
A blacklist is a legitimate interest isn't it?
tscs37 9y ago
Preventing abuse is a legimitate interest to keep data even if deletion is requested. For the same reason users can't request you delete all copies of bills and receipts on them.
r3bl 9y ago
> where you're given a giant list of IPs and emails to copy into the ban settings page? If you're behind HN, and I email you and tell you to delete CM30's profile, would you do it or would you request me to prove ownership of the profile? If you're behind HN, and I email you asking you to delete thousands of accounts, would you just do it or would you request me to prove ownership of those 1000 profiles? Point being: You're not gonna delete anything until you have verified that the user is really who he is claiming to be.

geocar 9y ago

You're allowed to log people's IP addresses for diagnostic reasons, to prevent fraud and abuse. You don't have to delete these logs when someone emails you if they're still useful for those purposes. You do need to delete those logs eventually though, and you need to disclose how often that is. It can be ten years if you want. If you're not using IP addresses for those reasons, you shouldn't collect it. It is good advice to mask off the bottom bits of the IP address since it will still likely be unique enough for you, without being useful to someone who has an unrelated list of IP addresses. You should probably be doing that anyway: If you get hacked, you're basically giving your attacker a list of targets. You should be able to delete usernames, passwords and email addresses on request. You should be able to remember that request if you restore from backups. You should not be storing passwords since that puts your users at risk if you get hacked, and you're responsible for keeping their personal data safe.

Silhouette 9y ago
You don't have to delete these logs when someone emails you if they're still useful for those purposes. You do need to delete those logs eventually though, and you need to disclose how often that is. It can be ten years if you want. That sort of argument has worked pretty well for Disney and friends when it comes to extending copyright indefinitely and yet not technically violating the US constitution's "temporary" wording. I wonder how well it will work in this case. How can anyone possibly make a reasonable, intelligent, a priori assessment of how long that data will be useful for that kind of purpose? It is good advice to mask off the bottom bits of the IP address since it will still likely be unique enough for you, without being useful to someone who has an unrelated list of IP addresses. That isn't necessarily true if, for example, you're using IP addresses to detect a pattern of abusive access within a general pool of acceptable access. And if a full IP address isn't enough to potentially identify a specific threat, it surely also isn't enough to constitute personal data. Either way, your advice seems excessively broad here. You should be able to delete usernames, passwords and email addresses on request. You should be able to remember that request if you restore from backups. Doing this effectively without immediately becoming self-contradictory probably requires something like storing a hash of every user name or email address that has had deletion requested, and querying a database of such hashes during the restoration process in order to exclude affected data. While this may well be in the spirit of the GDPR, there is no denying that it is extremely onerous, particularly for anyone working with personal data who rarely if ever receives such a request yet would have to redesign a large part of their IT infrastructure around the ability to do it.

jimnotgym 9y ago

Usernames are not necessarilly personally identifying, and are freely given by the user to be publicly displayed on a forum. Passwords are not personnally indentifying, and you shouldn't be storing them anyway!

majewsky 9y ago
> Usernames are not necessarily personally identifying Literally the only purpose of usernames is identifying people. I don't know the actual text of the GDPR, so I don't know the definition of "personally identifying", but I find it very strange that people seem to restrict the definition of "personally identifying" to "connects directly to your IRL identity".
- grabeh 9y ago
  The distinction stems partly from the US-EU divide. US use the term personally identifiable information (PII). This has a narrow definition and relates to that which connects your real identify. However, 'PII' is not a concept under EU data protection law which instead uses the far broader term of personal data. Personal data is both PII and any information which could be used to identify someone when combined with other information. As you suggest, a username is likely to be personal data because in lots of cases it is used as a unique ID and is used by the same person across multiple sites to identify them.