4 ms·

It's a bit disingenuous of you to skip the immediately preceding paragraph, which explains how the court determined whether the website operator "has the legal

It's a bit disingenuous of you to skip the immediately preceding paragraph, which explains how the court determined whether the website operator "has the legal means" or not, and highlights that in Germany, specific legal channels exist for a website operator in the event of cyber attacks to get this information. > Although the referring court states in its order for reference that German law does not allow the internet service provider to transmit directly to the online media services provider the additional data necessary for the identification of the data subject, it seems however, subject to verifications to be made in that regard by the referring court that, in particular, in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.

mytailorisrich 4y ago
OK, I might retract my comment about Germany specifically. But the wider point remains that an IP address isn't generally personal data in itself. Certainly this is quite irrelevant to the point here, which is a simple flag for dark mode. If that has to create and endless and tedious debate then the GDPR are not fit for purpose, but I maintain that it is fine to store it without explicit consent because it is not personal data in itself and, in any case, there is a legitimate interest to do so.
- d1sxeyes 4y ago
  Although this judgement was in Germany, I don’t see a reason that it would not apply to any other EU state, and I haven’t found any case law that says that an IP address in isolation is not personal data. Anyway, there’s no requirement for any piece of data to be independently identifying in order for it to come under the scope of personal data per GDPR. A piece of information is personal data if it can be linked to an individual. This applies whether the linking can be done in isolation or only with other pieces of information, and whether the link is explicit or inferred, direct or indirect, and whether the controller/processor has immediate access to the other pieces of data or not. Even if you rely on legitimate interest as a basis for processing personal data (and you might do, depending on your actual interests), you still have to do your paperwork, complete the PIAs and balancing tests.
  - mytailorisrich 4y ago
    The GDPR and this very case law say that an IP address in isolation and in general is not personal data. Indeed, the case law explicitly says that an IP address is personal data IF the controller has or has a way to get additional data to make the person identifiable (which is what the GDPR already explicitly say). No-one is identifiable with an IP address only, there must be additional data, which I need to possess or have access to, even if only in specific cases (which is the key point of this German case law).
    - d1sxeyes 4y ago
      OK

mytailorisrich 4y ago

OK, I might retract my comment about Germany specifically. But the wider point remains that an IP address isn't generally personal data in itself. Certainly this is quite irrelevant to the point here, which is a simple flag for dark mode. If that has to create and endless and tedious debate then the GDPR are not fit for purpose, but I maintain that it is fine to store it without explicit consent because it is not personal data in itself and, in any case, there is a legitimate interest to do so.

d1sxeyes 4y ago
Although this judgement was in Germany, I don’t see a reason that it would not apply to any other EU state, and I haven’t found any case law that says that an IP address in isolation is not personal data. Anyway, there’s no requirement for any piece of data to be independently identifying in order for it to come under the scope of personal data per GDPR. A piece of information is personal data if it can be linked to an individual. This applies whether the linking can be done in isolation or only with other pieces of information, and whether the link is explicit or inferred, direct or indirect, and whether the controller/processor has immediate access to the other pieces of data or not. Even if you rely on legitimate interest as a basis for processing personal data (and you might do, depending on your actual interests), you still have to do your paperwork, complete the PIAs and balancing tests.
- mytailorisrich 4y ago
  The GDPR and this very case law say that an IP address in isolation and in general is not personal data. Indeed, the case law explicitly says that an IP address is personal data IF the controller has or has a way to get additional data to make the person identifiable (which is what the GDPR already explicitly say). No-one is identifiable with an IP address only, there must be additional data, which I need to possess or have access to, even if only in specific cases (which is the key point of this German case law).
  - d1sxeyes 4y ago
    OK