3 ms·
OK. I'll bite. Starting from your list of "straightforward compliance" here are a few things which a small business owner cannot figure our without an expensive
by nickpp 9y ago
OK. I'll bite. Starting from your list of "straightforward compliance" here are a few things which a small business owner cannot figure our without an expensive lawyer.
1) Define "unless you have to". Am I allowed to keep business correspondence with a bad customer? With a prospective sale? With an old customer who may come back some day?
2) Define "data". Is the IP address any user sends to my site in order to simply access it "personal"? Does that mean I can't have logs? How about backups of those logs? Do I need to change the tools I am using that already generate logs? How straightforward is that?
3) Can I have analytics of my visitor base in order to optimize their experience? To understand churn and conversion rate?
5) Can I have statistics in my apps in order to understand and optimize their usage for the users?
6) Keeping data secure and allowing users to see and delete it will simply require other tools. That is not gonna be cheap or straightforward in any way.
Now I am not saying this is impossible. I am just saying that it's expensive and difficult, especially for a small business. NOT straightforward.
- DanBC 9y ago> Is the IP address any user sends to my site in order to simply access it "personal"? No. Something is only personal data if it can be used to identify a natural person.
- nickpp 9y agoAre you willing to defend this answer in a court of law? Many GDPR lawyers disagree...
- mstolpm 9y agoThe IP address IS considered personal data by european courts. You can be compliant by either only storing an anonymized IP address (set the last/couple of last to 0) or by not storing the IP logs at all. However, there might be resonable situations where you need the full IP address and the GDPR allows to store it in this case, but only for a specific reason and a limited time, and only if you documented it so the user is aware about the process. Reasons could be fraud protection, consent documentation (mailing list opt-in), error handling and so on ... but not "we don't really need it but store the IP address anyways without informing our users". See here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... "Examples of personal data: a name and surname; a home address; an email address such as name.surname@company.com; an identification card number; location data (for example the location data function on a mobile phone); an Internet Protocol (IP) address; a cookie ID; the advertising identifier of your phone; data held by a hospital or doctor, which could be a symbol that uniquely identifies a person."
- Volundr 9y agoTo be honest, this one feels in conflict with keeping the data secure. The full IP address may be important to forensics in the instance of a data breach.