4 ms·

I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl

by VMG 8y ago

I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs > All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).

peteretep 8y ago
> Article 4, Point 1 Article 4 Point 1 is: > (1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It is very far from clear that that covers IP addresses, which tend to be recycled, and would need a police warrant + actual evidence to then map to a specific human > and Recital 49 http://www.privacy-regulation.eu/en/r49.htm http://www.privacy-regulation.eu/en/r49.htm Failing to see the relevance
- VMG 8y ago
  https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ > [...] The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant. https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip-address-constitute-personal-data https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip... > What does the GDPR say? > [...] Recital 30 clarifies that "online identifier" includes IP addresses. http://www.privacy-regulation.eu/en/r30.htm http://www.privacy-regulation.eu/en/r30.htm > (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.
- quohM0Ho 8y ago
  > It is very far from clear that that covers IP addresses, which tend to be recycled Enter stage left: Address van Six, carrying an EUI64 card in his right hand.
dboreham 8y ago
A quick read of that article suggests to me that it is just wrong.

by VMG 8y ago

peteretep 8y ago

> Article 4, Point 1 Article 4 Point 1 is: > (1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It is very far from clear that that covers IP addresses, which tend to be recycled, and would need a police warrant + actual evidence to then map to a specific human > and Recital 49 http://www.privacy-regulation.eu/en/r49.htm http://www.privacy-regulation.eu/en/r49.htm Failing to see the relevance

VMG 8y ago
https://eugdprcompliant.com/personal-data/ https://eugdprcompliant.com/personal-data/ > [...] The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant. https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip-address-constitute-personal-data https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip... > What does the GDPR say? > [...] Recital 30 clarifies that "online identifier" includes IP addresses. http://www.privacy-regulation.eu/en/r30.htm http://www.privacy-regulation.eu/en/r30.htm > (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.
quohM0Ho 8y ago
> It is very far from clear that that covers IP addresses, which tend to be recycled Enter stage left: Address van Six, carrying an EUI64 card in his right hand.

dboreham 8y ago

A quick read of that article suggests to me that it is just wrong.