4 ms·

IP address is PII, though. The fact that you're processing it into broader categories in order to make an automated decision is neither here nor there. Logging

IP address is PII, though. The fact that you're processing it into broader categories in order to make an automated decision is neither here nor there. Logging HTTP requests is allowed not because it contains no sensitive data, but because you have a legitimate interest in logging usage of the web server in order to defend yourself against computer crimes, for example. What you aren't allowed to do is retain these logs indefinitely as if they weren't sensitive.

eganist 8y ago
> IP address is PII, though. Your premise appears to be flawed in the context of established case law. IP addresses alone are not considered 'personal data' unless you have the capacity to readily add other information to add color. See below: https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-... > The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if: > 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and > 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. > On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD. The vast majority of entities do not meet the requirements for #2.
- MatthewWilkes 8y ago
  Fair point. Pretty much all of my data protection work recently has been with sites that can identify the person, sorry, I let thay context affect what I said. That said, doesn't this assume the user has a dynamic IP address? You can't easily tell a dynamic from a static, so wouldn't you have to plan for the worst?
  - joshuamorton 8y ago
    Maybe, but firewalling an IP range doesn't actually require logging the specific ips. I don't think gdpr has any teeth for information that isn't actually stored.
    - reitanqild 8y ago
      > I don't think gdpr has any teeth for information that isn't actually stored. But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily. But then the law has already been followed. Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.
pmlnr 8y ago
By the way, why is IP so important to this many? The only reason I can think of is browser fingerprinting, but for that, IP is actually secondary. Why even bother storing IP apart from temporary/ephemeral security, say, fail2ban?
- TomK32 8y ago
  Not just IPs, The regulation knows about all of them (including RFID): Preamble paragraph 30: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
  - pmlnr 8y ago
    That's not what I meant, I'm curious why people want to store IPs apart from the security applications, which usually only need it temporarily.
    - tatersolid 8y ago
      You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs with full IPs and source ports for at least that long?
      - pmlnr 8y ago
        No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.

eganist 8y ago

> IP address is PII, though. Your premise appears to be flawed in the context of established case law. IP addresses alone are not considered 'personal data' unless you have the capacity to readily add other information to add color. See below: https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-... > The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if: > 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and > 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. > On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD. The vast majority of entities do not meet the requirements for #2.

MatthewWilkes 8y ago
Fair point. Pretty much all of my data protection work recently has been with sites that can identify the person, sorry, I let thay context affect what I said. That said, doesn't this assume the user has a dynamic IP address? You can't easily tell a dynamic from a static, so wouldn't you have to plan for the worst?
- joshuamorton 8y ago
  Maybe, but firewalling an IP range doesn't actually require logging the specific ips. I don't think gdpr has any teeth for information that isn't actually stored.
  - reitanqild 8y ago
    > I don't think gdpr has any teeth for information that isn't actually stored. But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily. But then the law has already been followed. Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.

pmlnr 8y ago

By the way, why is IP so important to this many? The only reason I can think of is browser fingerprinting, but for that, IP is actually secondary. Why even bother storing IP apart from temporary/ephemeral security, say, fail2ban?

TomK32 8y ago
Not just IPs, The regulation knows about all of them (including RFID): Preamble paragraph 30: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
- pmlnr 8y ago
  That's not what I meant, I'm curious why people want to store IPs apart from the security applications, which usually only need it temporarily.
  - tatersolid 8y ago
    You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs with full IPs and source ports for at least that long?
    - pmlnr 8y ago
      No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.