4 ms·

Because name field in a comment form is personal data in GDPR. IP address is also considered personal data in GDPR. And GDPR requires that we publish a privacy

Because name field in a comment form is personal data in GDPR. IP address is also considered personal data in GDPR. And GDPR requires that we publish a privacy statement about how personal data is going to be stored/used/shared. I am not going to share this data with any party. But due to access logs and showing comments, this data is going to be saved on disk. A good template for privacy statement can help a lot. This is a solved problem for open source licenses. It would be great if there is something like that for privacy statement too.

mytailorisrich 4y ago
IP addresses in themselves are not personal data but it is indeed a good idea to handle them carefully. If you do collect personal data and are stickler for the letter of the law you can just state which personal data you collect and for what purpose. No-one will bother you if you are indeed only a small blog.
- eminent101 4y ago
  IP address seems to be personal data here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Many other articles I read also agree with above.
  - mytailorisrich 4y ago
    We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. A more nuanced, and realistic explanation may be found at [1] (UK GDPR is the same as EU GDPR but Brexit...) That does not really help about your question, though. Again, if you clearly state what is collected and why you should be more than fine. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
    - ThePowerOfFuet 4y ago
      > We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. iP addresses are within scope of GDPR, period. Source: I hold CIPP/E certification
      - mytailorisrich 4y ago
        > iP addresses are within scope of GDPR, period. This sentence does not mean anything. The actual position regarding IP addresses as personal data is that "an IP address may be personal data if you are able to access additional information which enable you to identify the user behind the IP address", hence my previous statement. Unfortunately, this is often oversimplified (as tends to happen to any non-trivial issue) to "an IP address is personal data". It does mean, though, that one must be careful when handling IP addresses and may treat them as personal data by default as a belt and braces approach (as I already mentioned in my first comment), but that's not the same thing.
        ThePowerOfFuet 4y ago
        >may treat them as personal data by default as a belt and braces approach I'm glad we agree.
      - eminent101 4y ago
        Thanks! May I ask how you would handle this scenario - A blog has a commenting feature where users can type in their name (possibly full name) and a comment. There is no user registration or email address collection/verification. Any user on the internet can type in a name (an anonymous name or a real name like Bob Yan) and their comment and submit it. Web server access logs are kept in the server for 30 days. Does it fall within the scope of GDPR? If yes then how is the right to have personal data erased implemented? How would you process a request from someone with the name Bob Yan asking you to delete all comments posted by 'Bob Yan' on your website? Without a user registration or an email, how would you verify that the Bob Yan contacting you is the one who posted all those comments? This part seems to be very confusing. I'd appreciate any knowledge or tips you can share about this.

mytailorisrich 4y ago

IP addresses in themselves are not personal data but it is indeed a good idea to handle them carefully. If you do collect personal data and are stickler for the letter of the law you can just state which personal data you collect and for what purpose. No-one will bother you if you are indeed only a small blog.

eminent101 4y ago
IP address seems to be personal data here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Many other articles I read also agree with above.
- mytailorisrich 4y ago
  We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. A more nuanced, and realistic explanation may be found at [1] (UK GDPR is the same as EU GDPR but Brexit...) That does not really help about your question, though. Again, if you clearly state what is collected and why you should be more than fine. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
  - ThePowerOfFuet 4y ago
    > We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. iP addresses are within scope of GDPR, period. Source: I hold CIPP/E certification
    - mytailorisrich 4y ago
      > iP addresses are within scope of GDPR, period. This sentence does not mean anything. The actual position regarding IP addresses as personal data is that "an IP address may be personal data if you are able to access additional information which enable you to identify the user behind the IP address", hence my previous statement. Unfortunately, this is often oversimplified (as tends to happen to any non-trivial issue) to "an IP address is personal data". It does mean, though, that one must be careful when handling IP addresses and may treat them as personal data by default as a belt and braces approach (as I already mentioned in my first comment), but that's not the same thing.
      - ThePowerOfFuet 4y ago
        >may treat them as personal data by default as a belt and braces approach I'm glad we agree.
    - eminent101 4y ago
      Thanks! May I ask how you would handle this scenario - A blog has a commenting feature where users can type in their name (possibly full name) and a comment. There is no user registration or email address collection/verification. Any user on the internet can type in a name (an anonymous name or a real name like Bob Yan) and their comment and submit it. Web server access logs are kept in the server for 30 days. Does it fall within the scope of GDPR? If yes then how is the right to have personal data erased implemented? How would you process a request from someone with the name Bob Yan asking you to delete all comments posted by 'Bob Yan' on your website? Without a user registration or an email, how would you verify that the Bob Yan contacting you is the one who posted all those comments? This part seems to be very confusing. I'd appreciate any knowledge or tips you can share about this.