3 ms·

That's not true; I can only assume you're reading the 2011-era DPA guidance. Under GDPR, an IP address must explicitly be considered as personal data, and any

That's not true; I can only assume you're reading the 2011-era DPA guidance. Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/documentation/how-do-we-document-our-processing-activities/ https://ico.org.uk/for-organisations/guide-to-the-general-da... As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.

geocar 8y ago
Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1]) [1]: https://news.ycombinator.com/item?id=17060280 https://news.ycombinator.com/item?id=17060280 The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.
- ealexhudson 8y ago
  Jurisprudence in this area disagrees with you: "online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user" http://curia.europa.eu/juris/document/document.jsf?text=&docid=186346&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=53422 http://curia.europa.eu/juris/document/document.jsf?text=&doc... This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data). So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig. I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example). I understand that's not the outcome you're looking for.
  - geocar 8y ago
    I'm ignoring German opinions since Art 51-52 suggest only the ICO is going to be involved. > if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig. Using IP addresses for audit and security is best practices; I can use the IP address to make sure that a user isn't logging in from two countries at the same time (and then require a call e.g. to whitelist). Thinking of an IP address in binary, as you're suggesting is extremely dangerous: The GDPR is not supposed to prevent you from thinking about what you're doing. > That's reflected in their site (I gave you a specific example). Your example doesn't come out and say IP Addresses are always personal data. Try again. They've previously said the opposite: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe...
    - ealexhudson 8y ago
      So, three things. First, the case reference I gave you. That "German opinion" is from the Court of Justice of the European Union. This is the highest court that applies, and the ICO must obey it (until Brexit - and even after then, it's highly unlikely that the UK will interpret the GDPR in a different manner, at least for some time). Second, I've said before IP addresses might not always be personal data. But the issue is they sometimes are, and if you record them without discrimination then you're recording personal data. The old guidance says "An IP address is only likely to be personal data if relates to a PC or other device that has a single user" - ok, so are you able to not record IP addresses that do relate to a single-user device? No? Third, the ICO do think IP addresses count. I've given you a GDPR reference already, even their DPA tool treats them as such: https://ico.org.uk/for-organisations/making-data-protection-your-business/making-data-protection-your-business-self-assessment/y https://ico.org.uk/for-organisations/making-data-protection-... It genuinely doesn't matter what the ICO might have said in the past. Right now, they say IP addresses are personal data. The courts say that. The law says that. I've given you multiple references for all of this.
      - 8y ago

geocar 8y ago

Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1]) [1]: https://news.ycombinator.com/item?id=17060280 https://news.ycombinator.com/item?id=17060280 The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.

ealexhudson 8y ago
Jurisprudence in this area disagrees with you: "online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user" http://curia.europa.eu/juris/document/document.jsf?text=&docid=186346&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=53422 http://curia.europa.eu/juris/document/document.jsf?text=&doc... This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data). So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig. I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example). I understand that's not the outcome you're looking for.
- geocar 8y ago
  I'm ignoring German opinions since Art 51-52 suggest only the ICO is going to be involved. > if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig. Using IP addresses for audit and security is best practices; I can use the IP address to make sure that a user isn't logging in from two countries at the same time (and then require a call e.g. to whitelist). Thinking of an IP address in binary, as you're suggesting is extremely dangerous: The GDPR is not supposed to prevent you from thinking about what you're doing. > That's reflected in their site (I gave you a specific example). Your example doesn't come out and say IP Addresses are always personal data. Try again. They've previously said the opposite: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe...
  - ealexhudson 8y ago
    So, three things. First, the case reference I gave you. That "German opinion" is from the Court of Justice of the European Union. This is the highest court that applies, and the ICO must obey it (until Brexit - and even after then, it's highly unlikely that the UK will interpret the GDPR in a different manner, at least for some time). Second, I've said before IP addresses might not always be personal data. But the issue is they sometimes are, and if you record them without discrimination then you're recording personal data. The old guidance says "An IP address is only likely to be personal data if relates to a PC or other device that has a single user" - ok, so are you able to not record IP addresses that do relate to a single-user device? No? Third, the ICO do think IP addresses count. I've given you a GDPR reference already, even their DPA tool treats them as such: https://ico.org.uk/for-organisations/making-data-protection-your-business/making-data-protection-your-business-self-assessment/y https://ico.org.uk/for-organisations/making-data-protection-... It genuinely doesn't matter what the ICO might have said in the past. Right now, they say IP addresses are personal data. The courts say that. The law says that. I've given you multiple references for all of this.
    - 8y ago