3 ms·
If your server logs contain personal information then you are doing something horribly wrong and I hope you don't operate in the EU. Don't log sensitive data.
by cardanome 2y ago
If your server logs contain personal information then you are doing something horribly wrong and I hope you don't operate in the EU.
Don't log sensitive data. You don't need that for debugging.
- jfengel 2y agoIt didn't say "sensitive data". It says "any data". Though any server log is going to contain an IP address, which is at least a little sensitive.
- cardanome 2y agoYou should anonymize IP-addresses in your log files.
- lq9AJ8yrfs 2y agoBut this is the same problem! The GDPR and such define PII so broadly that more or less everything in web server logs is included in the definition. Not sensitive PII, but still PII that the individual has rights and interests over. That is more or less on purpose, and they do have a point. Rogue debugging on the other hand is not what they are worried about vs using the data in web logs for targeting, profiling, etc. If you could sell your web logs, would you? Vs how much would someone pay reddit or github for theirs? And would you be ok with that if your browse history was in there?
- robin_reala 2y agoTo be clear, the GDPR never uses the term Personally Identifying Information. It uses PD or Personal Data: this can be identifying on its own, but it’s more likely that some aggregate of multiple pieces of PD become identifying only when taken together.