5 ms·

How does this affect server logs? Under the "what is personal data" section they list ip addresses as personal data.

by seanalltogether 8y ago

matthewmacleod 8y ago
It requires you to have a management and retention policy for server logs which contain personal data.
bennyp101 8y ago
Do you have a legitimate reason for storing that data? Probably not, so just stop it from being logged.
- snowwolf 8y ago
  Yes. One of the key parts of GDPR is breach reporting. Assume you discover your company has been breached. How do you investigate the breach? Discover who was impacted, what was done and by whom? Is that significantly harder/impossible if your logs don't contain IP addresses? Edit: Also consider Log retention. Yahoo discovered a data breach 3 years after it happened. What if they'd only kept logs for 1 year.
- dwild 8y ago
  Never have been in a DDOS attack? Good luck doing anything without getting the IP. It's useful to know where the requests come from too. You get a bunch of request from IP that come from a specific peer and that peer is saturated? How could you verify that without a log? You want to add CDN to the right locations. Where should you? Really, I think it's just make more sense for any small company to block EU and when you have the means to do it correctly (with the help of a competent DPO), then yeah add that EU in your market.
dbbk 8y ago
Don't log ip addresses, or anonymise them.
- akvadrako 8y ago
  How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.
  - grabeh 8y ago
    You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available. Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
    - akvadrako 8y ago
      Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect. Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.
      - grabeh 8y ago
        If your reference to 'you' means someone running a site who only has possession of a reduced IP address, then how would connection work? Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location? On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?

How does this affect server logs? Under the "what is personal data" section they list ip addresses as personal data.

matthewmacleod 8y ago

It requires you to have a management and retention policy for server logs which contain personal data.

bennyp101 8y ago

Do you have a legitimate reason for storing that data? Probably not, so just stop it from being logged.

snowwolf 8y ago
Yes. One of the key parts of GDPR is breach reporting. Assume you discover your company has been breached. How do you investigate the breach? Discover who was impacted, what was done and by whom? Is that significantly harder/impossible if your logs don't contain IP addresses? Edit: Also consider Log retention. Yahoo discovered a data breach 3 years after it happened. What if they'd only kept logs for 1 year.
dwild 8y ago
Never have been in a DDOS attack? Good luck doing anything without getting the IP. It's useful to know where the requests come from too. You get a bunch of request from IP that come from a specific peer and that peer is saturated? How could you verify that without a log? You want to add CDN to the right locations. Where should you? Really, I think it's just make more sense for any small company to block EU and when you have the means to do it correctly (with the help of a competent DPO), then yeah add that EU in your market.

dbbk 8y ago

Don't log ip addresses, or anonymise them.

akvadrako 8y ago
How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.
- grabeh 8y ago
  You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available. Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
  - akvadrako 8y ago
    Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect. Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.
    - grabeh 8y ago
      If your reference to 'you' means someone running a site who only has possession of a reduced IP address, then how would connection work? Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location? On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?