3 ms·

IP address seems to be personal data here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/la

IP address seems to be personal data here: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Many other articles I read also agree with above.

mytailorisrich 4y ago
We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. A more nuanced, and realistic explanation may be found at [1] (UK GDPR is the same as EU GDPR but Brexit...) That does not really help about your question, though. Again, if you clearly state what is collected and why you should be more than fine. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- ThePowerOfFuet 4y ago
  > We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. iP addresses are within scope of GDPR, period. Source: I hold CIPP/E certification
  - mytailorisrich 4y ago
    > iP addresses are within scope of GDPR, period. This sentence does not mean anything. The actual position regarding IP addresses as personal data is that "an IP address may be personal data if you are able to access additional information which enable you to identify the user behind the IP address", hence my previous statement. Unfortunately, this is often oversimplified (as tends to happen to any non-trivial issue) to "an IP address is personal data". It does mean, though, that one must be careful when handling IP addresses and may treat them as personal data by default as a belt and braces approach (as I already mentioned in my first comment), but that's not the same thing.
    - ThePowerOfFuet 4y ago
      >may treat them as personal data by default as a belt and braces approach I'm glad we agree.
  - eminent101 4y ago
    Thanks! May I ask how you would handle this scenario - A blog has a commenting feature where users can type in their name (possibly full name) and a comment. There is no user registration or email address collection/verification. Any user on the internet can type in a name (an anonymous name or a real name like Bob Yan) and their comment and submit it. Web server access logs are kept in the server for 30 days. Does it fall within the scope of GDPR? If yes then how is the right to have personal data erased implemented? How would you process a request from someone with the name Bob Yan asking you to delete all comments posted by 'Bob Yan' on your website? Without a user registration or an email, how would you verify that the Bob Yan contacting you is the one who posted all those comments? This part seems to be very confusing. I'd appreciate any knowledge or tips you can share about this.
    - ThePowerOfFuet 4y ago
      If the blog is purely for personal/household use, it would be entirely exempt from the GDPR per Article 2(2)(c) GDPR. Otherwise, it falls within the scope of the GDPR even re the access logs if IP addresses are logged.
      - eminent101 4y ago
        Thanks for the answer! The blog has visitors from other geographic locations (both in EU and outside EU). Those visitors also post comments with their names included in comments. Those comments are then made available on the internet. So I am doubtful if it falls in purely personal use category. https://gdprhub.eu/Article_2_GDPR https://gdprhub.eu/Article_2_GDPR says: > According to Lindqvist in particular, the publication of personal data on a blogging site made available to an unlimited number of people would 'obviously' not be subject to the household exemption. For now, let us assume that the commenter name and IP addresses fall within the scope of GDPR. Do you have any comments about how the right to erasure would be implemented in the scenario I described in my comment above?
        ThePowerOfFuet 4y ago
        The right to erasure is not absolute; there is no basis to request erasure of web server access logs, for example.

mytailorisrich 4y ago

We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. A more nuanced, and realistic explanation may be found at [1] (UK GDPR is the same as EU GDPR but Brexit...) That does not really help about your question, though. Again, if you clearly state what is collected and why you should be more than fine. [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

ThePowerOfFuet 4y ago
> We're diverging from your question here, but I'll stick to my previous comment: an IP address is not in itself personal data. iP addresses are within scope of GDPR, period. Source: I hold CIPP/E certification
- mytailorisrich 4y ago
  > iP addresses are within scope of GDPR, period. This sentence does not mean anything. The actual position regarding IP addresses as personal data is that "an IP address may be personal data if you are able to access additional information which enable you to identify the user behind the IP address", hence my previous statement. Unfortunately, this is often oversimplified (as tends to happen to any non-trivial issue) to "an IP address is personal data". It does mean, though, that one must be careful when handling IP addresses and may treat them as personal data by default as a belt and braces approach (as I already mentioned in my first comment), but that's not the same thing.
  - ThePowerOfFuet 4y ago
    >may treat them as personal data by default as a belt and braces approach I'm glad we agree.
- eminent101 4y ago
  Thanks! May I ask how you would handle this scenario - A blog has a commenting feature where users can type in their name (possibly full name) and a comment. There is no user registration or email address collection/verification. Any user on the internet can type in a name (an anonymous name or a real name like Bob Yan) and their comment and submit it. Web server access logs are kept in the server for 30 days. Does it fall within the scope of GDPR? If yes then how is the right to have personal data erased implemented? How would you process a request from someone with the name Bob Yan asking you to delete all comments posted by 'Bob Yan' on your website? Without a user registration or an email, how would you verify that the Bob Yan contacting you is the one who posted all those comments? This part seems to be very confusing. I'd appreciate any knowledge or tips you can share about this.
  - ThePowerOfFuet 4y ago
    If the blog is purely for personal/household use, it would be entirely exempt from the GDPR per Article 2(2)(c) GDPR. Otherwise, it falls within the scope of the GDPR even re the access logs if IP addresses are logged.
    - eminent101 4y ago
      Thanks for the answer! The blog has visitors from other geographic locations (both in EU and outside EU). Those visitors also post comments with their names included in comments. Those comments are then made available on the internet. So I am doubtful if it falls in purely personal use category. https://gdprhub.eu/Article_2_GDPR https://gdprhub.eu/Article_2_GDPR says: > According to Lindqvist in particular, the publication of personal data on a blogging site made available to an unlimited number of people would 'obviously' not be subject to the household exemption. For now, let us assume that the commenter name and IP addresses fall within the scope of GDPR. Do you have any comments about how the right to erasure would be implemented in the scenario I described in my comment above?
      - ThePowerOfFuet 4y ago
        The right to erasure is not absolute; there is no basis to request erasure of web server access logs, for example.