15 ms·

IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.) Also, what pii is tracked (by default) by piwiki or ga or access logs? I

IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.) Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

toomuchtodo 8y ago
> Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything. Cookies and other artifacts in the request headers or query parameters that can identify a unique user.
- jimktrains2 8y ago
  Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.
  - toomuchtodo 8y ago
    True! But some cookies are usually tied to a user account, with an email address, and/or other PII. How careful are you with tacking cookies to requests? Be mindful, and keep documentation.
  - zaarn 8y ago
    Under the GDPR that's PII. IP Addresses too. Personal Data is any data relating to a natural person, if you can uniquely identify them that falls under the monitoring/profiling definition of the regulation.
TheForumTroll 8y ago
"A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant." https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ PII or not PII it is still covered by GDPR.

IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.) Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

toomuchtodo 8y ago

> Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything. Cookies and other artifacts in the request headers or query parameters that can identify a unique user.

jimktrains2 8y ago
Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.
- toomuchtodo 8y ago
  True! But some cookies are usually tied to a user account, with an email address, and/or other PII. How careful are you with tacking cookies to requests? Be mindful, and keep documentation.
- zaarn 8y ago
  Under the GDPR that's PII. IP Addresses too. Personal Data is any data relating to a natural person, if you can uniquely identify them that falls under the monitoring/profiling definition of the regulation.

TheForumTroll 8y ago

"A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant." https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ PII or not PII it is still covered by GDPR.