4 ms·

Hey, yours isn't complete either! :) Just by visiting your site, you are collecting my personal information (after all, GDPR says IP address is PII). So what a

Hey, yours isn't complete either! :) Just by visiting your site, you are collecting my personal information (after all, GDPR says IP address is PII). So what are you doing with it, and how long are you keeping it?

lmkg 7y ago
GDPR does not say that IP address is PII. Among other objections, GDPR does not mention IP address, nor does it mention PII. The current guidance on IP addresses is ambiguous, but my understanding is that an IP address on its own does not count as personal data. It can become personal data when it's used to create a profile. So if you only have the full IP fleetingly to serve web pages, and all logging wipes the last octet, there's no point where the data that you process counts as personal data.
- droithomme 7y ago
  GDPR doesn't get that specific, but the judges in the courts do. In Breyer v. Bundesrepublik Deutschland, E.C.J., No. C-582/14, 10/19/16, it was ruled that internet protocol addresses relating to visitors' use of websites constitutes "protected data" according to European Union laws.
  - lmkg 7y ago
    Thank you for the case citation. This is the summary I found: https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-10/cp160112en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201... My reading of that, and online commentary that I've found, seem to indicate that the IP address is not personal data across the board, but rather only in a specific context. I'm a little over my head in whether that specific context is "basically all the time" or not. It sounds like it only applies when you have the legal right to make the ISP give you subscriber info related to an IP address?
    - guitarbill 7y ago
      From that document and other reading, I think it's also when combination of information results in being able to identify a person. For example, dynamic IP address + timestamp is not enough for anybody but the ISP. But add in other information, for example HTTP headers, it might be unique enough. Also, what they're saying is some things trump privacy. Legal requirements to keep logs. Legitimate interest, e.g. billing. Defending against cyber attacks. Using that information for other purposes is still a no-no. TL;DR: IP address + other info often becomes PII, and there are some exceptional cases where it's legitimate to store PII despite privacy concerns.

lmkg 7y ago

GDPR does not say that IP address is PII. Among other objections, GDPR does not mention IP address, nor does it mention PII. The current guidance on IP addresses is ambiguous, but my understanding is that an IP address on its own does not count as personal data. It can become personal data when it's used to create a profile. So if you only have the full IP fleetingly to serve web pages, and all logging wipes the last octet, there's no point where the data that you process counts as personal data.

droithomme 7y ago
GDPR doesn't get that specific, but the judges in the courts do. In Breyer v. Bundesrepublik Deutschland, E.C.J., No. C-582/14, 10/19/16, it was ruled that internet protocol addresses relating to visitors' use of websites constitutes "protected data" according to European Union laws.
- lmkg 7y ago
  Thank you for the case citation. This is the summary I found: https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-10/cp160112en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201... My reading of that, and online commentary that I've found, seem to indicate that the IP address is not personal data across the board, but rather only in a specific context. I'm a little over my head in whether that specific context is "basically all the time" or not. It sounds like it only applies when you have the legal right to make the ISP give you subscriber info related to an IP address?
  - guitarbill 7y ago
    From that document and other reading, I think it's also when combination of information results in being able to identify a person. For example, dynamic IP address + timestamp is not enough for anybody but the ISP. But add in other information, for example HTTP headers, it might be unique enough. Also, what they're saying is some things trump privacy. Legal requirements to keep logs. Legitimate interest, e.g. billing. Defending against cyber attacks. Using that information for other purposes is still a no-no. TL;DR: IP address + other info often becomes PII, and there are some exceptional cases where it's legitimate to store PII despite privacy concerns.