4 ms·

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep m

The Apache logging can fall under legitimate interest for security/fraud prevention/debugging purposes, as long as it's kept for a reasonable duration (I keep mine for 3 months) and is not used for any other purpose such as marketing or analytics.

shadowgovt 3y ago
Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?
- rrdharan 3y ago
  > If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
  - shadowgovt 3y ago
    Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting. It's how you get war-on-drugs-level legal atrocities.
spacebanana7 3y ago
Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.
- gizmo 3y ago
  And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
  - spacebanana7 3y ago
    With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.
    - Nextgrid 3y ago
      That's technically an enforcement problem though. Hopefully one day regulators get the skills they need to see through this bullshit.
- djbusby 3y ago
  Logrotate is part of a lot of defaults (eg: Debian) and keeps only a few weeks of logs.

shadowgovt 3y ago

Is it not incumbent upon the admin to prove they didn't use the data for analytics? If so, that makes the data default-radioactive where before GDPR it was legally harmless. And what is "analytics" exactly? If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics?

rrdharan 3y ago
> If a one-person outfit happens to be skimming the logs and notices "Oh, neat, that's a lot of IP addresses from Germany," did they just do analytics? Yes. However enforcement is intentionally discretionary and selective and hence sensitive / prone to political, protectionist and sentimental whims. Your 1 person outfit in Europe is less likely to suffer in actual court, or the court of public opinion, than a big bad American tech company will.
- shadowgovt 3y ago
  Maybe it's just personal preference, but I find "This criminalizes a very common behavior, but don't worry, prosecutors will use broad discretion while enforcing it and only enforce it on the right sort of people" to be very, very disquieting. It's how you get war-on-drugs-level legal atrocities.

spacebanana7 3y ago

Defaults matter. Unless configured otherwise most logs are permanent and exist just because they might be useful sometime in the future.

gizmo 3y ago
And those defaults must be changed. GDPR rightly forces businesses to reconsider hoarding data because it “might be useful sometime in the future”.
- spacebanana7 3y ago
  With GDPR most businesses still hoard as much data as they can, then work backwards to find a plausible excuse like debugging or customer support.
  - Nextgrid 3y ago
    That's technically an enforcement problem though. Hopefully one day regulators get the skills they need to see through this bullshit.
djbusby 3y ago
Logrotate is part of a lot of defaults (eg: Debian) and keeps only a few weeks of logs.