6 ms·

Even writing an IP address in a web server log is considered "keeping data". Most of these news sites also have some form of "create an account to get updates /

Even writing an IP address in a web server log is considered "keeping data". Most of these news sites also have some form of "create an account to get updates / comment / vote" system, which would absolutely count as "keeping data". At the very least you still need a policy to give people telling them what data you keep and who you share it with. Even if that is nothing and no one, you need to be able to tell them that and you need someone who is responsible for handling those requests when they come in. "Just don't keep anything" is not a sufficient answer.

josteink 8y ago
> Even writing an IP address in a web server log is considered "keeping data" No it's not. Stop spreading FUD. If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic. The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs. (If you however mine the access log to derive or track users, that is another matter completely.)
- oytis 8y ago
  > (If you however mine the access log to derive or track users, that is another matter completely.) So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
  - marksomnian 8y ago
    If the data was obtained in violation, it follows that any processing, while not technically in violation, wouldn't be looked upon favourably. Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
  - Drakim 8y ago
    That seems like some twisted logic. "I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"
    - oytis 8y ago
      I mean if we can derive enough information about the user from the data that is strictly necessary otherwise, then the privacy is already doomed, and all efforts to protect it with some legislation will be inevitably in contradiction just with how technology works.
- yc-kraln 8y ago
  Yes, it is. You need to put into your privacy policy what you log (and yes, IP addresses are personal data) and how long your retention policy is. However, it's pretty easy to argue that IP addresses in logs are required (for a reasonable time, like a week) to provide the service. Might want to talk to a data protection officer before you go around swinging terms like FUD.

josteink 8y ago

> Even writing an IP address in a web server log is considered "keeping data" No it's not. Stop spreading FUD. If so, every part of every Internet-connected system on earth would be required to be completely redesigned to be GDPR-compliant. Demanding anything like that is not only unreasonable, it's 100% unrealistic. The GDPR is perfectly reasonable legislation and has legroom for obvious operational requirements, like access logs. (If you however mine the access log to derive or track users, that is another matter completely.)

oytis 8y ago
> (If you however mine the access log to derive or track users, that is another matter completely.) So under GDPR you're not allowed to process data you've already got? I wouldn't call this reasonable legislation.
- marksomnian 8y ago
  If the data was obtained in violation, it follows that any processing, while not technically in violation, wouldn't be looked upon favourably. Furthermore, although IANAL, I suspect that certain classes of processing fall under different rules, therefore the processing could potentially be in violation even if the collection wasn't.
- Drakim 8y ago
  That seems like some twisted logic. "I was just dumping data in logs, I don't have to care about privacy concerns. Oh, and now I have all this data on my server, since it's already here I surely deserve to process it without caring about privacy concerns!"
  - oytis 8y ago
    I mean if we can derive enough information about the user from the data that is strictly necessary otherwise, then the privacy is already doomed, and all efforts to protect it with some legislation will be inevitably in contradiction just with how technology works.
yc-kraln 8y ago
Yes, it is. You need to put into your privacy policy what you log (and yes, IP addresses are personal data) and how long your retention policy is. However, it's pretty easy to argue that IP addresses in logs are required (for a reasonable time, like a week) to provide the service. Might want to talk to a data protection officer before you go around swinging terms like FUD.