2 ms·
The consensus I've seen has been that you can't keep around server logs, especially not forever, just for abuse monitoring. GDPR considers IPs PII.
by jimmaswell 8y ago
The consensus I've seen has been that you can't keep around server logs, especially not forever, just for abuse monitoring. GDPR considers IPs PII.
- Someone1234 8y agoA "consensus" reached by a bunch of programmers who haven't even read the law has no merit in this discussion. What's clear is that GDPR prohibits using IP addresses to target content at particular individuals. But we aren't talking about that, we're talking about generic access logs. For example the law itself says: The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The UK's IPO for one example definitely doesn't agree with your assessment of the GDPR and it is their job to help companies adhere to it.