4 ms·
It doesn't. It says: > Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be
by edaemon 8y ago
It doesn't. It says:
> Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address.
Emphasis mine.
I said:
> IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.
- kasey_junk 8y agoYou are making a claim to one of 2 things: - the ip addresses never uniquely identify someone or - you have a legitimate interest to collecting this data. Neither provides carte blanche for collecting IP address.
- edaemon 8y agoI'm actually saying that both are a requirement for logging IPs in the circumstances being discussed here, but I certainly don't mean to suggest that either would grant you "carte blanche" to collect and log IPs.
- kasey_junk 8y agoI suspect that logging IP only for security purposes is fine, but the idea that it is a bulletproof defense is just wrong, we have no idea. Current indicators are that regulators think IP is personal & that legitimate interest defenses are suspect.
- KirinDave 8y agoHello, not a lawyer, but mine said you're wrong. You might be thinking of this pseudonymization stuff. My advice is not to play with it. Just delete your logs after a month unless you have a demonstrable and immediate security need for them.
- edaemon 8y agoWrong about what? I wasn't referring to pseudonymization; we thought that wasn't worth trying after the legal teams laid out what it involved. Log rotation is important, like I mentioned.
- AmericanChopper 8y agoI can't see any way in which this interpretation can be valid. You'll always be able to "directly or indirectly" identify people from IP addresses. Just because I don't store IP and identity together, doesn't mean there's not many other ways to identify somebody based on an IP address.
- edaemon 8y agoHow would one identify a person using only an IP address? If you have "other ways to identify somebody based on an IP address" then that wouldn't meet the criteria laid out by the lawyers.
- kasey_junk 8y agoI think the concern of the regulatory agencies (valid or not) is that there are db for sale that allow extremely precise locality information based on IP. Close enough to identify a household, which combined with other data can limit the data to a single person.