3 ms·
It's pretty crazy to me that people can feel this way after things like the Equifax breach. Equifax was sitting on all that data that people didn't even know th
by Drakim 9y ago
It's pretty crazy to me that people can feel this way after things like the Equifax breach. Equifax was sitting on all that data that people didn't even know they were included in, and probably didn't even WANT Equifax to possess.
But that's just business as usual, businesses are allowed to do things we consider morally wrong because that's just how things work.
And the second a law springs up that helps out the little guy, it's a massive governmental overreach. How dare government actually try to help people, think of all the businesses they are hurting!
- morgante 9y agoYou're using a non sequitur. Equifax is of course a massive data processor which should be regulated. Choosing to instead regulate every single person who even accidentally has an IP address in their logs somewhere is the overreach. This helps massive corporations (who can afford to comply) and hurts small businesses which cannot.
- mpfundstein 9y agoI never really felt the need to store ips actually
- tobltobs 9y agoYou might not, but your webserver did. Or did you change the logging configuration of your webserver to not store or obfuscate IPs in the past?
- pbhjpbhj 9y agoThis law suggests a shift to assuming no consent for gathering of PII, only gathering data when you have informed consent and a justifiable business need. In the case of web servers I can't see a problem with not recording IP if you're also gathering PII; or asking for permission in the PII submission; or say dropping the last digits from a dotted-quad as a default.
- NDizzle 9y agoYou don't want to log access requests to your web servers based on IP? I disagree with you at pretty much the lowest, most fundamental level.
- detaro 9y agoConsent is only one possible justification for processing, you do not need it for everything. It's more a shift to "processing PII is forbidden unless for one of the following reasons", consent being one of them, and requiring assigning purposes to collected data. You can't just have webserver logs piling up somewhere without reason, but you probably can have a policy like "We keep IP addresses for 48 hours for security purposes", if you have an appropriate security process needing that data.
- DanBC 9y ago> Choosing to instead regulate every single person who even accidentally has an IP address in their logs somewhere is the overreach. It doesn't help your argument when you misrepresent the truth like this. There's absolutely no requirement for every individual who accidentally has an IP address in their logs to comply with GDPR.