4 ms·

So the answer is yes, they are PII. But that doesn't actually answer the question of whether or not collecting them without consent is illegal under the GDPR >

So the answer is yes, they are PII. But that doesn't actually answer the question of whether or not collecting them without consent is illegal under the GDPR > “Processing shall be lawful only if and to the extent that at least one of the following applies: […] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” And > “The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.”

contem 8y ago
It depends on the purpose / if you have a legitimate need to store them. Are you storing IP's for a certain time, so you can discover and investigate attacks? > include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. Are you storing IP's for a certain time, so you can run analytics? > Further processing for [...] statistical purposes should be considered to be compatible lawful processing operations. Are you doing direct marketing to your customers? > The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. [Legitimate interest] There is a relevant and appropriate relationship between the data subject and the controller [...], such as where the data subject is a client or in the service of the controller. If you are not big enough to have a law department look at this, you don't need to worry so much about a weblog.
tetha 8y ago
I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and tracking a person attacking my network. Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.

contem 8y ago

It depends on the purpose / if you have a legitimate need to store them. Are you storing IP's for a certain time, so you can discover and investigate attacks? > include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems. Are you storing IP's for a certain time, so you can run analytics? > Further processing for [...] statistical purposes should be considered to be compatible lawful processing operations. Are you doing direct marketing to your customers? > The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. [Legitimate interest] There is a relevant and appropriate relationship between the data subject and the controller [...], such as where the data subject is a client or in the service of the controller. If you are not big enough to have a law department look at this, you don't need to worry so much about a weblog.

tetha 8y ago

I'm currently thinking with a blue security mindset. I'm currently wondering if there is a difference between tracking an abstract attacker of my network, and tracking a person attacking my network. Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.