3 ms·
If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address per
by gingerlime 9y ago
If all information you have about a person is their email (and usage data) then this won’t make a difference though... The GDPR considers even an IP address personal data, even if you have no way to correlate it with a real person. So where does this leave you if you have to respond?
Imagine I’m sending a request for information from a given IP address, requesting all the personal information you hold on that IP. I kinda proved that I’m using this IP and it’s part of my private data... but providing all information on this IP is likely to leak data on other people and there’s no way legitimate the requester
- Grollicus 9y agoAn IP address is only personal data in combination with a timestamp or similar time-related information. I don't see an attack scenario where an attacker would gain anything useful. Note that he's propably still risking jail time over this.
- smokeyj 9y ago> Note that he's propably still risking jail time over this. I feel like most criminals are OK with that.
- merinowool 9y agoDo you have a source of that?
- zaarn 9y agoGerman courts have ruled that IP addresses are personal data. EU courts so far agree. The timestamp is irrelevant. The GDPR makes anything that can be potentially traced back to a person personal data, it's a much wider definition than PII. It also means that constructing data sets may lead to personal data being generated out of non-personal data. So even if you only store IPs without timestamp, if you stored timestamps elsewhere and you could reconstruct the IP of the user, you're up for grabs.