3 ms·
I'm not a lawyer, so this isn't legal advice. "Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseite
by Janisbtw 3y ago
I'm not a lawyer, so this isn't legal advice.
"Die dynamische IP-Adresse stellt für einen Webseitenbetreiber ein personenbezogenes Datum dar, denn der Webseitenbetreiber verfügt abstrakt über rechtliche Mittel, die vernünftigerweise eingesetzt werden könnten, um mithilfe Dritter, und zwar der zuständigen Behörde und des Internetzugangsanbieters, die betreffende Person anhand der gespeicherten IP-Adressen bestimmen zu lassen (BGH, Urteil vom 16.05.2017 - VI ZR 135/13). Dabei reicht es aus, dass für die Beklagte die abstrakte Möglichkeit der Bestimmbarkeit der Personen hinter der IP-Adresse besteht. Darauf, ob die Beklagte oder X. die konkrete Möglichkeit hat, die IP-Adresse mit dem Kläger zu verknüpfen, kommt es nicht an." - "The dynamic IP address represents personal data for a website operator, because the website operator has abstract legal means that could reasonably be used to identify the person concerned using the stored IP to have addresses determined (Federal Court of Justice, judgment of May 16, 2017 - VI ZR 135/13). It is sufficient that the defendant has the abstract possibility of identifying the persons behind the IP address. Whether the defendant or X. has the specific opportunity to link the IP address to the plaintiff is irrelevant." (translated by google) (https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ - Ruling by the Regional Court Munich)
As far as I understood, it all depends on your intention, not on the data itself. Yes, you can store someones email address if it's necessary to run your service. If you don't have a legal basis, you can't.
I think it's comparable to an id card number. This should be considered personal, because it's unique and links a user to a real person. You can't identify them in the real world, because you don't have access to a government database.
Reminder: I'm not a lawyer, so this isn't legal advice.
- marvinblum 3y agoAlright, so no more DDoS protection or rate limiting. Do we need consent before a router or switch on the network can process traffic? Isn't the ISP violating the GDPR if they hand out information about a customer to third parties without consent? What about servers that have logs turned on (Apache) before GDPR went into effect? I know the opinion of lawyers about IP addresses. But it's so far from reality that it would break the internet if strictly followed.
- chrismorgan 3y agoConsent is only one of the legal bases for personal data processing. An ISP or other network intermediary will use “contractual obligation”.
- Janisbtw 3y agoI'm not a lawyer, so this isn't legal advice. "Handling personal data Personal data may not be processed, including its storage and transmission, without a legal basis (Article 6). These legal bases are not applicable to cookies. Consent: The user has given clear consent for a specific purpose with an affirmative action. Contractual obligation: ‘Contract’ in this case may include terms of service. Legal obligation Vital interests: Saving one’s life. Public task Legitimate interests" This was in the article, having security logs probably counts as a legitimate interest. Also ISPs giving away your information without your consent and reason is violating the GDPR. Reminder: I'm not a lawyer, so this isn't legal advice.
- hartator 3y agoYes, and it’s why GDPR is a very bad law. If you follow to the letter, Internet is disallowed in the EU.