3 ms·

If the definition of personal data includes IP addresses then I'd be surprised there are any internet-connected products that don't process personal data in som

by eli 8y ago

If the definition of personal data includes IP addresses then I'd be surprised there are any internet-connected products that don't process personal data in some way.

jdietrich 8y ago
>If the definition of personal data includes IP addresses Yes it does. > I'd be surprised there are any internet-connected products that don't process personal data in some way. Consent is one of six lawful grounds for processing personal data. Another ground is legitimate interests, described in Article 5 as follows: "Processing shall be lawful if... processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Recital 49 goes on to state: "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems." Logging IPs for a reasonable period of time as part of your network security infrastructure is perfectly permissible under GDPR without consent. You can share your server logs with a third-party security company or pass data to a DDoS protection service if needed. If you use those IPs for any other purpose (ad tracking, analytics etc) then you'll need lawful grounds for those activities, which may or may not require consent.
- aeorgnoieang 8y ago
  What's your theory about why so many seem to be doing such a bad job meeting the letter and spirit of the law? Are they consulting with lawyers or other legal experts and bending over backwards to do the best they can given the advice they're given? Or are they maliciously flouting the obvious requirements as part of a concerted, and possibly coordinated, effort to undermine the law?
  - PeterisP 8y ago
    IMHO the process in many of these places was ran something like delegating it all to the legal department and treating it as a challenge of adjusting their privacy policies and other legal documents, but not expecting (or allowing) that project to change any of their core business processes. However, in many (most?) cases that cannot possibly be sufficient to comply, so we're seeing how the legal people have done as much as they could to cover their arses, given that the actual behavior of the company around them wasn't allowed to change. It also may be that some companies are intentionally planning a delaying tactic - i.e. a plan to flip the switch on private data processing only when the regulators will get to them and start writing stern letters, so that they can reap the benefits of (ab)using user data for some more months.
  - jdietrich 8y ago
    I think that there are two contrary trends. Large companies that substantially profit from personal data are testing the boundaries of GDPR. They've got competent legal advice and know that a blatant effort would earn the wrath of the regulators, so they're being subtle about it. They're creatively interpreting grey areas. They're using complex and confusing opt-outs justified by spurious technical issues. They're carefully planning a strategy that will allow them to drag out the enforcement process and gain as much ground as possible, while maintaining the pretence that they're making a good-faith effort to comply. They'd rather avoid a heavy fine, but they're not afraid of butting heads with the regulators. A lot of small companies without in-house counsel are going a bit crazy. Maybe they've spoken to a data protection consultant who has fed them a bunch of FUD, maybe they've just read a few articles in the press, but they haven't really scrutinised the text of the GDPR or spoken to a regulatory authority. They don't understand what their obligations are under the GDPR or the overarching principles of data protection, but they're doing something. Sometimes that thing is completely overzealous, sometimes it's totally inadequate. I've seen a lot of misguided efforts by SMEs to indemnify themselves against GDPR, akin to the "no copyright intended" statements you see in YouTube descriptions. Many of these companies had been completely ignoring the old Data Protection Directive, so they've got a lot of catching up to do.

by eli 8y ago

If the definition of personal data includes IP addresses then I'd be surprised there are any internet-connected products that don't process personal data in some way.

jdietrich 8y ago

>If the definition of personal data includes IP addresses Yes it does. > I'd be surprised there are any internet-connected products that don't process personal data in some way. Consent is one of six lawful grounds for processing personal data. Another ground is legitimate interests, described in Article 5 as follows: "Processing shall be lawful if... processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ Recital 49 goes on to state: "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems." Logging IPs for a reasonable period of time as part of your network security infrastructure is perfectly permissible under GDPR without consent. You can share your server logs with a third-party security company or pass data to a DDoS protection service if needed. If you use those IPs for any other purpose (ad tracking, analytics etc) then you'll need lawful grounds for those activities, which may or may not require consent.

aeorgnoieang 8y ago
What's your theory about why so many seem to be doing such a bad job meeting the letter and spirit of the law? Are they consulting with lawyers or other legal experts and bending over backwards to do the best they can given the advice they're given? Or are they maliciously flouting the obvious requirements as part of a concerted, and possibly coordinated, effort to undermine the law?
- PeterisP 8y ago
  IMHO the process in many of these places was ran something like delegating it all to the legal department and treating it as a challenge of adjusting their privacy policies and other legal documents, but not expecting (or allowing) that project to change any of their core business processes. However, in many (most?) cases that cannot possibly be sufficient to comply, so we're seeing how the legal people have done as much as they could to cover their arses, given that the actual behavior of the company around them wasn't allowed to change. It also may be that some companies are intentionally planning a delaying tactic - i.e. a plan to flip the switch on private data processing only when the regulators will get to them and start writing stern letters, so that they can reap the benefits of (ab)using user data for some more months.
- jdietrich 8y ago
  I think that there are two contrary trends. Large companies that substantially profit from personal data are testing the boundaries of GDPR. They've got competent legal advice and know that a blatant effort would earn the wrath of the regulators, so they're being subtle about it. They're creatively interpreting grey areas. They're using complex and confusing opt-outs justified by spurious technical issues. They're carefully planning a strategy that will allow them to drag out the enforcement process and gain as much ground as possible, while maintaining the pretence that they're making a good-faith effort to comply. They'd rather avoid a heavy fine, but they're not afraid of butting heads with the regulators. A lot of small companies without in-house counsel are going a bit crazy. Maybe they've spoken to a data protection consultant who has fed them a bunch of FUD, maybe they've just read a few articles in the press, but they haven't really scrutinised the text of the GDPR or spoken to a regulatory authority. They don't understand what their obligations are under the GDPR or the overarching principles of data protection, but they're doing something. Sometimes that thing is completely overzealous, sometimes it's totally inadequate. I've seen a lot of misguided efforts by SMEs to indemnify themselves against GDPR, akin to the "no copyright intended" statements you see in YouTube descriptions. Many of these companies had been completely ignoring the old Data Protection Directive, so they've got a lot of catching up to do.