5 ms·

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well bu

Not a lawyer, but sat in waaaay too many meeting with lawyers on this very subject as we built a GDPR framework for a past-employer. It certainly means well but makes a number of jumps that are wrong or untested. For example; some things flagged as personal data (like IP address) are not always considered personal data depending on how it is used. Like, logging IP addresses for the purpose of security is an extremely widespread practice and considered necessary. Likewise, storing data on a personal device (like a cookie) is ok if it is necessary for the service to function (as opposed to unnecessary tracking data or non-critical information). Storing data that manages a session, log-in state, shopping cart, dark-mode preference, is ok) Thats just a sample. This person should really consult a lawyer. Reminder: I am not a lawyer.

chrismorgan 3y ago
Your examples are both bad. IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security. Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.
marvinblum 3y ago
I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be able to get the exact location or tell how many people are in the household with just the IP address. I'm ready to get downvoted by the "we don't want any analytics" crowd on HN.
- Janisbtw 3y ago
  I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich) As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't. I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database. Reminder: I'm not a lawyer, so this isn't legal advice.
  - marvinblum 3y ago
    Alright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect? I know the opinion of lawyers about IP addresses. But it's so far from reality that it would break the internet if strictly followed.
    - chrismorgan 3y ago
      Consent is only one of the legal bases for personal data processing. An ISP or other network intermediary will use “contractual obligation”.
    - Janisbtw 3y ago
      I'm not a lawyer, so this isn't legal advice. "Handling personal data Personal data may not be processed, including its storage and transmission, without a legal basis (Article 6). These legal bases are not applicable to cookies. Consent: The user has given clear consent for a specific purpose with an affirmative action. Contractual obligation: ‘Contract’ in this case may include terms of service. Legal obligation Vital interests: Saving one’s life. Public task Legitimate interests" This was in the article, having security logs probably counts as a legitimate interest. Also ISPs giving away your information without your consent and reason is violating the GDPR. Reminder: I'm not a lawyer, so this isn't legal advice.
    - hartator 3y ago
      Yes, and it’s why GDPR is a very bad law. If you follow to the letter, Internet is disallowed in the EU.
- graftak 3y ago
  You get the same security benefits by truncating and/or hashing the ip address before storage.
pier25 3y ago
The fact that lawyers are needed and even some lawyers get GDPR wrong is a testament at the failure of GDPR. I'm all for privacy but the EU really harmed SMEs that cannot afford expensive legal help.
- chrismorgan 3y ago
  GDPR as a whole is very accessible legislation. The entire document (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...) isn’t short: 54,000 words. But it’s very skimmable so that you can obviously skip quickly over the considerable majority as irrelevant to your situation, and generally pretty easy to read. The parts relevant to the typical developer or business person are actually only a few thousand words of chapters 1–4. I recommend just reading it if it might be relevant to your business, rather than relying on others’ writings about it. Most of the lawyerly arguments come from people trying to justify bad stuff that they used to get away with but which is clearly contrary to the spirit and generally text of GDPR. (This is my uncharitable description.)
  - pier25 3y ago
    > Most of the lawyerly arguments come from people trying to justify bad stuff I'm not trying to justify bad stuff. Even experts in the matter debate about it. I've been reading about GDPR for weeks and am still not certain I have everything covered to launch my SaaS.

chrismorgan 3y ago

Your examples are both bad. IP addresses aren’t being considered not personal data (expressed without the double negative: IP addresses are still personal data), they’re just being processed under the “legitimate interest” lawful basis when it comes to things like security. Storing functional cookies: the article discussed this in the ePD section, look for “strictly required”.

marvinblum 3y ago

I couldn't agree more. If IP addresses are considered PII, we can basically shut down the internet. They are necessary to protect against spammers and attacks. Also, as you have mentioned, an IP address can _not_ be linked to a natural person, as you can't tell who it belongs to without context. For an ISP for example an IP address is linked to a customer, everyone else can only guess who it belongs to. You won't be able to get the exact location or tell how many people are in the household with just the IP address. I'm ready to get downvoted by the "we don't want any analytics" crowd on HN.

Janisbtw 3y ago
I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich) As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't. I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database. Reminder: I'm not a lawyer, so this isn't legal advice.
- marvinblum 3y ago
  Alright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect? I know the opinion of lawyers about IP addresses. But it's so far from reality that it would break the internet if strictly followed.
  - chrismorgan 3y ago
    Consent is only one of the legal bases for personal data processing. An ISP or other network intermediary will use “contractual obligation”.
  - Janisbtw 3y ago
    I'm not a lawyer, so this isn't legal advice. "Handling personal data Personal data may not be processed, including its storage and transmission, without a legal basis (Article 6). These legal bases are not applicable to cookies. Consent: The user has given clear consent for a specific purpose with an affirmative action. Contractual obligation: ‘Contract’ in this case may include terms of service. Legal obligation Vital interests: Saving one’s life. Public task Legitimate interests" This was in the article, having security logs probably counts as a legitimate interest. Also ISPs giving away your information without your consent and reason is violating the GDPR. Reminder: I'm not a lawyer, so this isn't legal advice.
  - hartator 3y ago
    Yes, and it’s why GDPR is a very bad law. If you follow to the letter, Internet is disallowed in the EU.
graftak 3y ago
You get the same security benefits by truncating and/or hashing the ip address before storage.

pier25 3y ago

The fact that lawyers are needed and even some lawyers get GDPR wrong is a testament at the failure of GDPR. I'm all for privacy but the EU really harmed SMEs that cannot afford expensive legal help.

chrismorgan 3y ago
GDPR as a whole is very accessible legislation. The entire document (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...) isn’t short: 54,000 words. But it’s very skimmable so that you can obviously skip quickly over the considerable majority as irrelevant to your situation, and generally pretty easy to read. The parts relevant to the typical developer or business person are actually only a few thousand words of chapters 1–4. I recommend just reading it if it might be relevant to your business, rather than relying on others’ writings about it. Most of the lawyerly arguments come from people trying to justify bad stuff that they used to get away with but which is clearly contrary to the spirit and generally text of GDPR. (This is my uncharitable description.)
- pier25 3y ago
  > Most of the lawyerly arguments come from people trying to justify bad stuff I'm not trying to justify bad stuff. Even experts in the matter debate about it. I've been reading about GDPR for weeks and am still not certain I have everything covered to launch my SaaS.