4 ms·

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics). Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data. IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-electronic-communications/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/how-do-the-cookie-rules-relate-to-the-gdpr/#GDPR2 https://ico.org.uk/for-organisations/direct-marketing-and-el...

derefr 3y ago
How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.
- kzzzznot 3y ago
  I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
  - cccbbbaaa 3y ago
    Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.
    - kzzzznot 3y ago
      Does an IP alongside a HTTP request count as personal data?
      - cccbbbaaa 3y ago
        An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
- cccbbbaaa 3y ago
  Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recommandation_-_journalisation.pdf https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.

derefr 3y ago

How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.

kzzzznot 3y ago
I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line. A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.
- cccbbbaaa 3y ago
  Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find. > ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1489-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.
  - kzzzznot 3y ago
    Does an IP alongside a HTTP request count as personal data?
    - cccbbbaaa 3y ago
      An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
cccbbbaaa 3y ago
Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recommandation_-_journalisation.pdf https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.