3 ms·
The coverage of GDPR I've seen (and in my view, the regulation itself) has been pretty clear that data becomes covered "personal data" only to the extent that t
by Lazare 8y ago
The coverage of GDPR I've seen (and in my view, the regulation itself) has been pretty clear that data becomes covered "personal data" only to the extent that the data, in aggregate, can be used to identify a real person.
So an IP address on its own is almost never personal data, because of wifi, NAT, dynamic IPs, shared devices, etc. Then again, a name is almost never personal data on its own either, "John Smith" could refer to any one hundreds of thousands or people or it could be a pseudonym and refer to literally billions of people.
But if someone registers on your site, and you log the IP address and their name, you're a lot closer to persona data. Add a timestamp, and you probably can identify a real person.
So if you're trying to be careful about GDPR, you should probably be careful about storing IP addresses (or IP addresses that can be linked to other bits of potentially personal data). The focus of GDPR compliance can't be on "oh this field is fine, but this field is personal data", it should be on what you're collecting in aggregate. That makes IP addresses dangerous, because they provide a lot of information that could be used to identify someone.
- apple4ever 8y agoBut as the article points out, adding a time stamp only will matter if you have access to other data to map it to a real person. So based on my reading, IPs and time stamps are not PII unless you are an ISP or you link them to other PII (so still the IP and time stamps are really irrelevant because they depend on that other PII).
- shabble 8y agoYou're unlikely to be storing only (IP, timestamp) data though. Presumably there's some additional info attached to those records that makes it useful for something. A web access-log records (ts, ip, request, ...), or maybe your application log stores (ts, ip, action, params, ...) So the information from that single source is "at time T, IP accessed RESOURCE". It's possible that's personally identifiable in context (if you have additional controls that RESOURCE can only be accessed by exactly 1 real person, etc) But say it's not. All you know is: Opaque PERSON accessed RESOURCE. if you can obtain the identifying information from elsewhere (buy, steal, etc) from ISP or whatever, you now know that (T, IP) = NAMEDPERSON. A simple lookup/matching means you know that NAMEDPERSON accessed RESOURCE. That's the new personal data. The IP isn't irrelevant, because without it, you'd have no lookup key to determine the mapping from PERSON? to NAMEDPERSON.
- apple4ever 8y agoRight there may be more information, but none of that is personally identifiable without additional information- information that cannot be obtained legally or easily. So the IP is irrelevant.