6 ms·

I thought IPs are not considered personal identifiable information.

midasz 8y ago
It depends. If they can be traced back to a single person, they are. However you also have dynamic IP addresses - multiple people using the same IP.. I wouldn't call it a gross violation.
kasey_junk 8y ago
PII is not a concept of GDPR. Whether IPs are considered personal data covered by GDPR is open to interpretation, but most of the experts I've talked to say yes.
- scrumbledober 8y ago
  As does the official website faq
muro 8y ago
Yes it is - it's in the FAQ: https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html What constitutes personal data? Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.
- M2Ys4U 8y ago
  That is not an official website - if you read the footer you'll see the following text: "Disclaimer: This is not an offical EU Commission or Government resource. This is a education portal and the information contained within this portal does in no way constitute legal advice. Any person who intends to rely upon or use the information contained herein in any way is solely responsible for independently verifying the information and obtaining independent expert advice if required."
  - hadrien01 8y ago
    The official EU Commission website[1] still says it's personal data: > Examples of personal data > [...] > - an Internet Protocol (IP) address; [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- wtfstatists 8y ago
  I like this definiton better. IANAL Warning. Personal Data: - PII is Personal Data. - If a user has PII, then all of the userdata is Personal Data. So HN posts would not be Personal Data for the users that have email field empty. And even email (and any other user-entered data) can be made non-PII if ToU explicitly required to be so. My advice would be to legally and technically isolate PII and other_userdata. GDPR/etc compliance become quite easier this way.
  - dogma1138 8y ago
    ToU don’t change what PII is or isn’t under the GDPR. The GDPR also states that consent alone isn’t a legal reason to collect or process PII and “advises” against relying and structuring terms of service to collect PII. Basically you can’t build a service ask people for their data and then relying on their consent for the legal reasoning of having that data. You need an actual legal basis e.g. a regulatory requirement or a business requirement to collect that data, and in all cases the requirements unless stated in law must be evaluated against the best interests of those you collect data from.
    - wtfstatists 8y ago
      > ToU don’t change what PII is or isn’t under the GDPR. ToU can by prohibiting user from entering any PII. In case of email, ToU would say that only non-identifying email can be used. For the rest of your comment, I dont see any relevance here. There is no need for consent for non-PII userdata. All PII userdata is behind legal and technical wall and cannot be accessed by the processor/controller of non-PII userdata.
      - dogma1138 8y ago
        There is no such thing as a “non-identifiable” email. You cannot use ToU to bypass GDPR.
        wtfstatists 8y ago
        Ok here is my email: 1373f84998986cf8@tutanota.com. Identify me! Know that I wont used the email elsewhere. > You cannot use ToU to bypass GDPR. Just to clarify this is not buried in ToU but laid out clearly. So the website says dont give PII. User still does. And GDPR would penalize the website ? Citation please.
tpetry 8y ago
The GDPR decided otherwise ;) IPs are now PII with all the problems you will now have: every system storing (even temporary) an ip address (e.g. access logs) for a short term are processing (storage is processing) personal information.
jacquesm 8y ago
The safe approach is to assume they are, unless you are 100% sure that there are a large number of people behind a single IP. The easiest way to deal with this is to nul the last octet, that way you still have plenty of use cases covered with respect to analytics (but not forensics!) and the IP is no longer PII. If you wish to keep IPs for forensic reasons then you will have to put some kind of reasonable upper limit on how long you will keep them (say 90 days) if no specific reason to keep an IP (say an active investigation) comes up in that time justifying further retention.
jackweirdy 8y ago
It's nuanced > If the processor has the legal option to oblige the provider to publish additional information which can identify the user who is behind the IP address, this is also personal data. https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/
mgliwka 8y ago
It's personal data according to GDPR, see this FAQ from the EU commission: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

It depends. If they can be traced back to a single person, they are. However you also have dynamic IP addresses - multiple people using the same IP.. I wouldn't call it a gross violation.

kasey_junk 8y ago

PII is not a concept of GDPR. Whether IPs are considered personal data covered by GDPR is open to interpretation, but most of the experts I've talked to say yes.

scrumbledober 8y ago
As does the official website faq

muro 8y ago

Yes it is - it's in the FAQ: https://www.eugdpr.org/gdpr-faqs.html https://www.eugdpr.org/gdpr-faqs.html What constitutes personal data? Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.

M2Ys4U 8y ago
That is not an official website - if you read the footer you'll see the following text: "Disclaimer: This is not an offical EU Commission or Government resource. This is a education portal and the information contained within this portal does in no way constitute legal advice. Any person who intends to rely upon or use the information contained herein in any way is solely responsible for independently verifying the information and obtaining independent expert advice if required."
- hadrien01 8y ago
  The official EU Commission website[1] still says it's personal data: > Examples of personal data > [...] > - an Internet Protocol (IP) address; [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
wtfstatists 8y ago
I like this definiton better. IANAL Warning. Personal Data: - PII is Personal Data. - If a user has PII, then all of the userdata is Personal Data. So HN posts would not be Personal Data for the users that have email field empty. And even email (and any other user-entered data) can be made non-PII if ToU explicitly required to be so. My advice would be to legally and technically isolate PII and other_userdata. GDPR/etc compliance become quite easier this way.
- dogma1138 8y ago
  ToU don’t change what PII is or isn’t under the GDPR. The GDPR also states that consent alone isn’t a legal reason to collect or process PII and “advises” against relying and structuring terms of service to collect PII. Basically you can’t build a service ask people for their data and then relying on their consent for the legal reasoning of having that data. You need an actual legal basis e.g. a regulatory requirement or a business requirement to collect that data, and in all cases the requirements unless stated in law must be evaluated against the best interests of those you collect data from.
  - wtfstatists 8y ago
    > ToU don’t change what PII is or isn’t under the GDPR. ToU can by prohibiting user from entering any PII. In case of email, ToU would say that only non-identifying email can be used. For the rest of your comment, I dont see any relevance here. There is no need for consent for non-PII userdata. All PII userdata is behind legal and technical wall and cannot be accessed by the processor/controller of non-PII userdata.
    - dogma1138 8y ago
      There is no such thing as a “non-identifiable” email. You cannot use ToU to bypass GDPR.
      - wtfstatists 8y ago
        Ok here is my email: 1373f84998986cf8@tutanota.com. Identify me! Know that I wont used the email elsewhere. > You cannot use ToU to bypass GDPR. Just to clarify this is not buried in ToU but laid out clearly. So the website says dont give PII. User still does. And GDPR would penalize the website ? Citation please.

tpetry 8y ago

The GDPR decided otherwise ;) IPs are now PII with all the problems you will now have: every system storing (even temporary) an ip address (e.g. access logs) for a short term are processing (storage is processing) personal information.

jacquesm 8y ago

The safe approach is to assume they are, unless you are 100% sure that there are a large number of people behind a single IP. The easiest way to deal with this is to nul the last octet, that way you still have plenty of use cases covered with respect to analytics (but not forensics!) and the IP is no longer PII. If you wish to keep IPs for forensic reasons then you will have to put some kind of reasonable upper limit on how long you will keep them (say 90 days) if no specific reason to keep an IP (say an active investigation) comes up in that time justifying further retention.

jackweirdy 8y ago

It's nuanced > If the processor has the legal option to oblige the provider to publish additional information which can identify the user who is behind the IP address, this is also personal data. https://gdpr-info.eu/issues/personal-data/ https://gdpr-info.eu/issues/personal-data/

mgliwka 8y ago

It's personal data according to GDPR, see this FAQ from the EU commission: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...