3 ms·

I don't really understand why. They just should not collect real names or any other personal information and then they would be fine.

lmkg 8y ago
Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.
- actuator 8y ago
  Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.
  - izacus 8y ago
    You've been talking to a bag lawyer then.
  - codedokode 8y ago
    > if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.
- codedokode 8y ago
  Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number. Quote [1]: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
landryraccoon 8y ago
IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.
- ec109685 8y ago
  Ask for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.
  - landryraccoon 8y ago
    So at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?
    - lagadu 8y ago
      Yes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.
      - codedokode 8y ago
        Please see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318 https://news.ycombinator.com/item?id=16964318
    - codedokode 8y ago
      The best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.
- codedokode 8y ago
  You don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address. I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration. Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.

lmkg 8y ago

Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.

actuator 8y ago
Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.
- izacus 8y ago
  You've been talking to a bag lawyer then.
- codedokode 8y ago
  > if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.
codedokode 8y ago
Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number. Quote [1]: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

landryraccoon 8y ago

IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.

ec109685 8y ago
Ask for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.
- landryraccoon 8y ago
  So at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?
  - lagadu 8y ago
    Yes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.
    - codedokode 8y ago
      Please see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318 https://news.ycombinator.com/item?id=16964318
  - codedokode 8y ago
    The best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.
codedokode 8y ago
You don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address. I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration. Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.