32 ms·

How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log

How does for example a small yoga studio’s email list fit in your examples? Or even just it’s website? Without cookies and login even - the IP adress in the log files alone is considered potential personal data that basically puts people in the need of consulting a lawyer about how to safely deal with that. And makes you a potential target to being sued and getting a lot of hassle. Even found nit guilty in the end, no one will pay days of time and energy needed for defense. And then: What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? You either have no option to reset passwords, or must do it by phone, which is extremely expensive.

beojan 8y ago
> the IP adress in the log files alone is considered potential personal data Stop logging the IP address then. Hopefully default settings in web servers will change. > What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account. > How does for example a small yoga studio’s email list fit in your examples? If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe. The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/ https://ico.org.uk/for-organisations/data-protection-fee/
- hennsen 8y ago
  Ip adresses are needed for security anslysis in case of attacks, for example. the thing is not about doing what you propose but that however you‘re doing it, you have a lot of bureaucracy and legal insecurity right now. The examples of wrongdoing you give should be leading to hard measures. But those with good intentions shouldn’t have high bureaucracy costs. To be clear: i don’t say these laws shouldn’t exist. They just should have been targeted at the actual wrongdoers and put smallest possible burden on all with no bad intentions.
  - remus 8y ago
    > Ip adresses are needed for security anslysis in case of attacks, for example. Then you have a legitimate need for the data, so store it for a reasonable length of time and then delete it.
  - ryanlol 8y ago
    >Ip adresses are needed for security anslysis in case of attacks, for example People repeat this a lot, but it sounds like complete nonsense. Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?
    - jexah 8y ago
      One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker. Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.
      - beojan 8y ago
        You can do that with a hash of the IP.
        ryanlol 8y ago
        How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext. I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
        beojan 8y ago
        Salt the hashes, perhaps use PBKDF2. The problem is solved for passwords, just treat IPs like low entropy passwords.
- ahallock 8y ago
  > Stop logging the IP address then. Hopefully default settings in web servers will change. But in legal matters, you need to identify people and have some kind of audit trail, especially if they tried to breach your system. That makes no sense.
  - beojan 8y ago
    Depends what's on the site. If it's just a static site, there isn't a lot of point trying to investigate a breach, just fix the changes and move on.
  - ryanlol 8y ago
    Why stop at IP addresses then? If IP addresses in logs are necessary for audit trails, why aren’t fingeprints?
    - hennsen 8y ago
      You put it to a total overexaggerated extreme here. That doesn’t help. IP adresses are not 1:1 assigned to a person for a whole lifetime, fingerprints are. Only with a lot additional effort and connection to other databases, IP adresses can actually be connected with a person, but only for an uncertain period of time, finding out this timespan, and ensuring it’s really only exactly this one person requires even more effort. So a properly crafted law would have made all these efforts illegal, and put high fines on them, but not the decades old practice of storing ip adresses in logfiles.
      - ryanlol 8y ago
        Why do you need to store IP addresses in log files? I understand audit logging for authenticated users, but that's hardly a general case.
        hennsen 8y ago
        Why are ip adresses even considered personal data? They aren’t for most people and situations, unless a lot if other activities are done. All of which would be already illegal without consent by the law. The ip adress i write this from changes every day, and nobody can know if i share it with someone or not. I want to be protected from marketing firms that sell my email adress , and everyone who uses it to send me mails for whatever product to buy judt because i entered it for some totally different reason. Those shall be fined with 5 figure amounts. I don’t see how my(and my housemates/office colleagues etc) ip in the logfiles of the webserver which a small business rented for 3€ to upload 3 html filed can be abused (without storing my email and name without consent which is actual personal data and therefore illegal) and i dont want my hairdresser, car mechanic etc be in need to consult a lawyer to understand all that stuff and have a day worth of bureaucracy and adfing a “we have your current ip in the logs” note just because they want me to be able to google their street adresses. The law is simply not well crafted for no use if the latter is the case.
belorn 8y ago
IP address are permitted under the security exception: Storing personal information in order to protect information or information systems is permitted without need for consent. Using your log files for security explicitly permitted and there is nothing that changed a system administrators job before or after GDPR on this point. If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so. Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP. Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.
- candiodari 8y ago
  So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should probably consult a lawyer to make sure. Correct ?
  - hennsen 8y ago
    Which is exactly my point put a bit shorter :)
  - zaarn 8y ago
    You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations). As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)
zeta0134 8y ago
I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.) I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?
- smokeyj 8y ago
  Many small business rely on wordpress because it's free and hosting is cheap. There's plugins for nearly every functionality you can imagine. Perhaps having them migrate to proprietary systems is the better solution, but I can't help but feel it's a net loss for the World Wide Web.
  - zeta0134 8y ago
    On the contrary, I think this is secretly a benefit. As soon as WordPress updates to include all the necessary tools to be GDPR compliant, every small business using their platform should be able to easily pull those features in with minimal developer work. The common platform is a boon here because it helps everyone work together on the issue, rather than requiring the smaller players to implement a mountain of work by themselves.
- olalonde 8y ago
  > I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. You just gave a perfect example of why GDPR will hurt startups and innovation.

beojan 8y ago

> the IP adress in the log files alone is considered potential personal data Stop logging the IP address then. Hopefully default settings in web servers will change. > What kind of online business can reasonably be done without using an email adress, if only for login/resetting password if lost? That means you have a legitimate interest, so long as you don't send marketing emails to those addresses, or sell them, and so long as you delete them if someone deletes their account. > How does for example a small yoga studio’s email list fit in your examples? If someone signs up to your email list, they've consented to receiving emails. Just don't sell the list, and remove people if they unsubscribe. The only real complication (if you're in the UK, I don't know about other countries) is that there is a fee to register as a data controller. https://ico.org.uk/for-organisations/data-protection-fee/ https://ico.org.uk/for-organisations/data-protection-fee/

hennsen 8y ago
Ip adresses are needed for security anslysis in case of attacks, for example. the thing is not about doing what you propose but that however you‘re doing it, you have a lot of bureaucracy and legal insecurity right now. The examples of wrongdoing you give should be leading to hard measures. But those with good intentions shouldn’t have high bureaucracy costs. To be clear: i don’t say these laws shouldn’t exist. They just should have been targeted at the actual wrongdoers and put smallest possible burden on all with no bad intentions.
- remus 8y ago
  > Ip adresses are needed for security anslysis in case of attacks, for example. Then you have a legitimate need for the data, so store it for a reasonable length of time and then delete it.
- ryanlol 8y ago
  >Ip adresses are needed for security anslysis in case of attacks, for example People repeat this a lot, but it sounds like complete nonsense. Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?
  - jexah 8y ago
    One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker. Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.
    - beojan 8y ago
      You can do that with a hash of the IP.
      - ryanlol 8y ago
        How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext. I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
        beojan 8y ago
        Salt the hashes, perhaps use PBKDF2. The problem is solved for passwords, just treat IPs like low entropy passwords.
ahallock 8y ago
> Stop logging the IP address then. Hopefully default settings in web servers will change. But in legal matters, you need to identify people and have some kind of audit trail, especially if they tried to breach your system. That makes no sense.
- beojan 8y ago
  Depends what's on the site. If it's just a static site, there isn't a lot of point trying to investigate a breach, just fix the changes and move on.
- ryanlol 8y ago
  Why stop at IP addresses then? If IP addresses in logs are necessary for audit trails, why aren’t fingeprints?
  - hennsen 8y ago
    You put it to a total overexaggerated extreme here. That doesn’t help. IP adresses are not 1:1 assigned to a person for a whole lifetime, fingerprints are. Only with a lot additional effort and connection to other databases, IP adresses can actually be connected with a person, but only for an uncertain period of time, finding out this timespan, and ensuring it’s really only exactly this one person requires even more effort. So a properly crafted law would have made all these efforts illegal, and put high fines on them, but not the decades old practice of storing ip adresses in logfiles.
    - ryanlol 8y ago
      Why do you need to store IP addresses in log files? I understand audit logging for authenticated users, but that's hardly a general case.
      - hennsen 8y ago
        Why are ip adresses even considered personal data? They aren’t for most people and situations, unless a lot if other activities are done. All of which would be already illegal without consent by the law. The ip adress i write this from changes every day, and nobody can know if i share it with someone or not. I want to be protected from marketing firms that sell my email adress , and everyone who uses it to send me mails for whatever product to buy judt because i entered it for some totally different reason. Those shall be fined with 5 figure amounts. I don’t see how my(and my housemates/office colleagues etc) ip in the logfiles of the webserver which a small business rented for 3€ to upload 3 html filed can be abused (without storing my email and name without consent which is actual personal data and therefore illegal) and i dont want my hairdresser, car mechanic etc be in need to consult a lawyer to understand all that stuff and have a day worth of bureaucracy and adfing a “we have your current ip in the logs” note just because they want me to be able to google their street adresses. The law is simply not well crafted for no use if the latter is the case.

belorn 8y ago

IP address are permitted under the security exception: Storing personal information in order to protect information or information systems is permitted without need for consent. Using your log files for security explicitly permitted and there is nothing that changed a system administrators job before or after GDPR on this point. If you are using a email list in order to fulfill a contract to your members by informing them about times and so on then that is also permitted by GDPR. If a customer buys a subscription then the company in order to fulfill their side of the contract can then naturally store information to do so. Mailing lists also has had a long history of best practices in order to not get marked as spam by the large email services. Get consent so users don't mark it as spam and allow unsubscribing. If a small yoga studio used a email list for a significant time and not been forced to do shady behavior in order to bypass spam filters, then they are almost guarantied to be compliant with GDRP. Similar an online business has a contract when a customer buy a product or service. In order to fulfill that contract a email address is commonly used. Perfect GDPR compliant. Hard to imagine a online business before GDRP that did not have a contract with customers.

candiodari 8y ago
So what you're saying is there's lots of complexity and nuances in how you do this with some commonly done things illegal and others not ... and you should probably consult a lawyer to make sure. Correct ?
- hennsen 8y ago
  Which is exactly my point put a bit shorter :)
- zaarn 8y ago
  You don't have to get it all right on the first try. If you get something wrong, the regulatory body will contact you (via letter or email) and tell you what they feel like is not correct (that is the official guidance on how to handle GDPR violations). As long as you do your best to implement the GDPR and interact with the regulatory agency in a friendly and helpful manner then there won't be much need for a lawyer (but do consider that the GDPR being written as it is is also the result of being written in the EU where law is written a bit differently)

zeta0134 8y ago

I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. Now compliance is largely handled by the tool makers, and the Yoga studio can focus on their business case and any custom coded extensions to ensure they remain compliant. (For popular stuff like Apache, compliant configurations are probably already available or will be shortly, once we all figure out if we are allowed to keep logging IP addresses by default.) I'm not sure I understand the email jab; obviously you can store data, you just must obtain consent first, and must allow the data to be deleted on request. That's an opt-in mailing list with an unsubscribe feature that actually works and properly deletes the relevant data. Why should that be difficult for a small business to do right?

smokeyj 8y ago
Many small business rely on wordpress because it's free and hosting is cheap. There's plugins for nearly every functionality you can imagine. Perhaps having them migrate to proprietary systems is the better solution, but I can't help but feel it's a net loss for the World Wide Web.
- zeta0134 8y ago
  On the contrary, I think this is secretly a benefit. As soon as WordPress updates to include all the necessary tools to be GDPR compliant, every small business using their platform should be able to easily pull those features in with minimal developer work. The common platform is a boon here because it helps everyone work together on the issue, rather than requiring the smaller players to implement a mountain of work by themselves.
olalonde 8y ago
> I would sincerely hope that the small Yoga studio is not attempting to custom code their website in this case, in which case the economical solution is for the Yoga studio to use a GDPR compliant website and mailing list toolset, and simply migrate to a different set if they find that they aren't. You just gave a perfect example of why GDPR will hurt startups and innovation.