4 ms·

GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address. You likely have a reason to log that dat

GDPR also expands what is personal data to include things that are collected as a matter of course such as IP address. You likely have a reason to log that data but GDPR requires that you document it. Further it reaches into your business even if you aren’t trying to do business in the EU, as EU citizens can come to your site without your control. There is a lot to like with GDPR but it absolutely is expansive & easy to have many interpretations.

ryandrake 9y ago
Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past. If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch to scrub PII from their logging, and these are probably simple diffs.
- merinowool 9y ago
  What if you have a forum and users of that forum commit a crime, police asks you to give up their data and you say you don't have any data?
  - wadkar 9y ago
    > you say you don’t have any data? And what’s wrong in telling the truth to the police? Sounds great to me. Also, see how signal responds to such requests.
- Silhouette 9y ago
  “Logging all the things” as default behavior really needs to be a thing of the past. Maybe, but logging useful things is reasonable. We investigate problems with our systems using server logs. We diagnose various security threats, fraud risks and ToS violations using server logs. We're generally respectful of users' privacy, but we also have a legitimate interest in knowing how our systems are being used and preventing people from doing bad things with them. Those legitimate interests may take precedence over a visitor's right to privacy in some cases, in the same way that you can't tell a government to forget your criminal record or a bank to forget that you owe them money.

ryandrake 9y ago

Maybe these things shouldn’t be collected as a matter of course. Should web servers log client IP addresses by default? Why? Does my mail server need to log email addresses of incoming mail by default? “Logging all the things” as default behavior really needs to be a thing of the past. If anyone wants to get their feet wet in open source, there are thousands of high profile projects out there that could use a patch to scrub PII from their logging, and these are probably simple diffs.

merinowool 9y ago
What if you have a forum and users of that forum commit a crime, police asks you to give up their data and you say you don't have any data?
- wadkar 9y ago
  > you say you don’t have any data? And what’s wrong in telling the truth to the police? Sounds great to me. Also, see how signal responds to such requests.
Silhouette 9y ago
“Logging all the things” as default behavior really needs to be a thing of the past. Maybe, but logging useful things is reasonable. We investigate problems with our systems using server logs. We diagnose various security threats, fraud risks and ToS violations using server logs. We're generally respectful of users' privacy, but we also have a legitimate interest in knowing how our systems are being used and preventing people from doing bad things with them. Those legitimate interests may take precedence over a visitor's right to privacy in some cases, in the same way that you can't tell a government to forget your criminal record or a bank to forget that you owe them money.