6 ms·

Im Germany you generally need to send a real letter (or a fax) and it needs to contain your signature. "Authentication" for this is provided by harsh penalties

Im Germany you generally need to send a real letter (or a fax) and it needs to contain your signature. "Authentication" for this is provided by harsh penalties on signature forgeries. Also, you'd only get one single data point and everything really sensitive has address data and they will* send their response to a known address.

gingerlime 9y ago
If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address personal data, even if you have no way to correlate it with a real person. So where does this leave you if you have to respond? Imagine I’m sending a request for information from a given IP address, requesting all the personal information you hold on that IP. I kinda proved that I’m using this IP and it’s part of my private data... but providing all information on this IP is likely to leak data on other people and there’s no way legitimate the requester
- Grollicus 9y ago
  An IP address is only personal data in combination with a timestamp or similar time-related information. I don't see an attack scenario where an attacker would gain anything useful. Note that he's propably still risking jail time over this.
  - smokeyj 9y ago
    > Note that he's propably still risking jail time over this. I feel like most criminals are OK with that.
  - merinowool 9y ago
    Do you have a source of that?
  - zaarn 9y ago
    German courts have ruled that IP addresses are personal data. EU courts so far agree. The timestamp is irrelevant. The GDPR makes anything that can be potentially traced back to a person personal data, it's a much wider definition than PII. It also means that constructing data sets may lead to personal data being generated out of non-personal data. So even if you only store IPs without timestamp, if you stored timestamps elsewhere and you could reconstruct the IP of the user, you're up for grabs.

gingerlime 9y ago

If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address personal data, even if you have no way to correlate it with a real person. So where does this leave you if you have to respond? Imagine I’m sending a request for information from a given IP address, requesting all the personal information you hold on that IP. I kinda proved that I’m using this IP and it’s part of my private data... but providing all information on this IP is likely to leak data on other people and there’s no way legitimate the requester

Grollicus 9y ago
An IP address is only personal data in combination with a timestamp or similar time-related information. I don't see an attack scenario where an attacker would gain anything useful. Note that he's propably still risking jail time over this.
- smokeyj 9y ago
  > Note that he's propably still risking jail time over this. I feel like most criminals are OK with that.
- merinowool 9y ago
  Do you have a source of that?
- zaarn 9y ago
  German courts have ruled that IP addresses are personal data. EU courts so far agree. The timestamp is irrelevant. The GDPR makes anything that can be potentially traced back to a person personal data, it's a much wider definition than PII. It also means that constructing data sets may lead to personal data being generated out of non-personal data. So even if you only store IPs without timestamp, if you stored timestamps elsewhere and you could reconstruct the IP of the user, you're up for grabs.