3 ms·

> IP address is PII, though. Your premise appears to be flawed in the context of established case law. IP addresses alone are not considered 'personal data' un

> IP address is PII, though. Your premise appears to be flawed in the context of established case law. IP addresses alone are not considered 'personal data' unless you have the capacity to readily add other information to add color. See below: https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-... > The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if: > 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and > 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. > On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD. The vast majority of entities do not meet the requirements for #2.

MatthewWilkes 8y ago
Fair point. Pretty much all of my data protection work recently has been with sites that can identify the person, sorry, I let thay context affect what I said. That said, doesn't this assume the user has a dynamic IP address? You can't easily tell a dynamic from a static, so wouldn't you have to plan for the worst?
- joshuamorton 8y ago
  Maybe, but firewalling an IP range doesn't actually require logging the specific ips. I don't think gdpr has any teeth for information that isn't actually stored.
  - reitanqild 8y ago
    > I don't think gdpr has any teeth for information that isn't actually stored. But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily. But then the law has already been followed. Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.

MatthewWilkes 8y ago

Fair point. Pretty much all of my data protection work recently has been with sites that can identify the person, sorry, I let thay context affect what I said. That said, doesn't this assume the user has a dynamic IP address? You can't easily tell a dynamic from a static, so wouldn't you have to plan for the worst?

joshuamorton 8y ago
Maybe, but firewalling an IP range doesn't actually require logging the specific ips. I don't think gdpr has any teeth for information that isn't actually stored.
- reitanqild 8y ago
  > I don't think gdpr has any teeth for information that isn't actually stored. But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily. But then the law has already been followed. Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.