3 ms·

Can we interpret have as can obtain? Do a geolookup, you have my approximate location. Do a Google search for my IP address and you'll have my name.

by clarry 8y ago

jlgaddis 8y ago
> Can we interpret have as can obtain? From my reading, you can interpret it that way if "the website operator has a 'legal means' of obtaining access to the information". Refer to the "What makes a dynamic IP address personal data?" section of TFA. (N.B.: I am not a lawyer. Ask your doctor if taking legal advice from strangers on the Internet is right for you.)
kekumu 8y ago
I would. Better to be overly cautious if you're serious about protecting user data and privacy. IPs specifically are quite likely to reveal some identifying info, and it's obvious how trivial it is to find that info. Even the company itself isn't looking that info up, losing that info could expose their users.
threeseed 8y ago
> Do a Google search for my IP address and you'll have my name. How does that happen exactly ?
- dylz 8y ago
  Business class internet at home often will reassign it to your full name and address, for example.
- clarry 8y ago
  You'll find my whois records as well as my personal domain names. Name is required on the whois record, but even if it could be anonymized, it'd still have the registrar's name. I am my registrar.
tjoff 8y ago
> Do a geolookup, you have my approximate location. Nowhere near "personally identifiable" nor necessarily correct in any way. > Do a Google search for my IP address and you'll have my name. That would be highly unusual.
- jlgaddis 8y ago
  It's certainly possible. There are plenty of people who have been assigned (usually small) subnets (e.g., a /28 or /29) and have their name, address, phone number, etc., publicly available via WHOIS. (For "residential customers", it was acceptable to not publish their personal details, however.) I'm not sure about the other RIRs but ARIN, at least, has (had?) a requirement that any assignment of a /29 or larger must be reported (see "SWIP" [0]). In other cases, a PTR RR for a single IP address could be enough to personally identify an individual. [0]: https://en.m.wikipedia.org/wiki/Shared_Whois_Project https://en.m.wikipedia.org/wiki/Shared_Whois_Project
  - tjoff 8y ago
    I think we have different meaning of plenty. Commercial entities doesn't really map to one person. I thought WHOIS would have to be amended to be compatible with GDPR anyway. I mean, you could create a website dedicated to mapping your current IP to yourself if you really wanted to, but that is hardly relevant.

Can we interpret have as can obtain? Do a geolookup, you have my approximate location. Do a Google search for my IP address and you'll have my name.

by clarry 8y ago

Can we interpret have as can obtain? Do a geolookup, you have my approximate location. Do a Google search for my IP address and you'll have my name.

jlgaddis 8y ago

> Can we interpret have as can obtain? From my reading, you can interpret it that way if "the website operator has a 'legal means' of obtaining access to the information". Refer to the "What makes a dynamic IP address personal data?" section of TFA. (N.B.: I am not a lawyer. Ask your doctor if taking legal advice from strangers on the Internet is right for you.)

kekumu 8y ago

I would. Better to be overly cautious if you're serious about protecting user data and privacy. IPs specifically are quite likely to reveal some identifying info, and it's obvious how trivial it is to find that info. Even the company itself isn't looking that info up, losing that info could expose their users.

threeseed 8y ago

> Do a Google search for my IP address and you'll have my name. How does that happen exactly ?

dylz 8y ago
Business class internet at home often will reassign it to your full name and address, for example.
clarry 8y ago
You'll find my whois records as well as my personal domain names. Name is required on the whois record, but even if it could be anonymized, it'd still have the registrar's name. I am my registrar.

tjoff 8y ago

> Do a geolookup, you have my approximate location. Nowhere near "personally identifiable" nor necessarily correct in any way. > Do a Google search for my IP address and you'll have my name. That would be highly unusual.

jlgaddis 8y ago
It's certainly possible. There are plenty of people who have been assigned (usually small) subnets (e.g., a /28 or /29) and have their name, address, phone number, etc., publicly available via WHOIS. (For "residential customers", it was acceptable to not publish their personal details, however.) I'm not sure about the other RIRs but ARIN, at least, has (had?) a requirement that any assignment of a /29 or larger must be reported (see "SWIP" [0]). In other cases, a PTR RR for a single IP address could be enough to personally identify an individual. [0]: https://en.m.wikipedia.org/wiki/Shared_Whois_Project https://en.m.wikipedia.org/wiki/Shared_Whois_Project
- tjoff 8y ago
  I think we have different meaning of plenty. Commercial entities doesn't really map to one person. I thought WHOIS would have to be amended to be compatible with GDPR anyway. I mean, you could create a website dedicated to mapping your current IP to yourself if you really wanted to, but that is hardly relevant.