3 ms·

I have taken the same stance. Have had lawyers tell me that I am wrong. Have had other lawyers telle the opposite. -shrug- when it specifically lists IP addres

I have taken the same stance. Have had lawyers tell me that I am wrong. Have had other lawyers telle the opposite. -shrug- when it specifically lists IP address as an example of PD in one section, the fact that another says things are only PD if you can identify a person doesn't NECESSARILY over rule that.

mikekchar 8y ago
I think a lot of this is a red herring. If you are gathering the IP address under the contract lawful basis, then it doesn't matter if it's personally identifying or not. Where it get's tricky is when you are not gathering the IP address under contract lawful basis. The tricky thing about GDPR is choosing the correct lawful basis. I think people reach for the legitimate interest card too quickly because they see it as a "get out of jail free" card. But then it ends up complicating things enormously -- especially since legitimate interest can be objected to. I've seen people agonising in public about what to do because the personally identifying information is necessary to provide the service they are offering. If you're in the situation where if someone objects to the use of their data, then it breaks the whole service -- well you're in contract lawful basis territory. IP addresses are potentially complicated, though. I'm not sure what's supposed to happen when you receive personally identifying information from someone that you don't have a contract with. The law does seem to be vague on what constitutes a "contract", because in some cases it seems to imply something different than what contract law says (i.e. if there is no consideration, it seems I can still use contract lawful basis). In this situation, if I have a P2P network and I need your IP address to fulfil my side of the protocol, then I should be able to use it under contract basis. However, I'm unclear about the actual legality of it -- especially when the information is sent to you by an intermediate node. To me, that's what needs to be cleared up. I expect it will be over a period of time. I don't think the law was written with that kind of stuff in mind. It's kind of interesting, though. I imagine it is a violation of the GDPR to track what individuals are downloading in bittorrent without giving them a legitimate interest notice, though (and allowing them to object! and be forgotten!). It will be interesting to see if anybody complains about that kind of thing.

mikekchar 8y ago

I think a lot of this is a red herring. If you are gathering the IP address under the contract lawful basis, then it doesn't matter if it's personally identifying or not. Where it get's tricky is when you are not gathering the IP address under contract lawful basis. The tricky thing about GDPR is choosing the correct lawful basis. I think people reach for the legitimate interest card too quickly because they see it as a "get out of jail free" card. But then it ends up complicating things enormously -- especially since legitimate interest can be objected to. I've seen people agonising in public about what to do because the personally identifying information is necessary to provide the service they are offering. If you're in the situation where if someone objects to the use of their data, then it breaks the whole service -- well you're in contract lawful basis territory. IP addresses are potentially complicated, though. I'm not sure what's supposed to happen when you receive personally identifying information from someone that you don't have a contract with. The law does seem to be vague on what constitutes a "contract", because in some cases it seems to imply something different than what contract law says (i.e. if there is no consideration, it seems I can still use contract lawful basis). In this situation, if I have a P2P network and I need your IP address to fulfil my side of the protocol, then I should be able to use it under contract basis. However, I'm unclear about the actual legality of it -- especially when the information is sent to you by an intermediate node. To me, that's what needs to be cleared up. I expect it will be over a period of time. I don't think the law was written with that kind of stuff in mind. It's kind of interesting, though. I imagine it is a violation of the GDPR to track what individuals are downloading in bittorrent without giving them a legitimate interest notice, though (and allowing them to object! and be forgotten!). It will be interesting to see if anybody complains about that kind of thing.