Hacker News Reader

Comment by havkom | Hacker News Reader

Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that. Do:

- Make a link to a privacy policy clearly accessible (eg on your website footer) and make sure it contains all of the required elements of information (see Article 13)

- Do not store the data longer than reasonable

- Do not worry too much about logs/backups etc as long as what you do is reasonable and you do have a reasonable delete schedule - no lawyers I have met seems to worry about this.

- Worry instead about for what purposes you actually use data you collect (what other orgs do you share data with, why, what do you do with the data that produces an effect on the data subject (eg marketing) etc)

View on HN

> Sounds like you have a legitimate interest in logging IP addresses for security purposes, it is an effective measure and that your legitimate interest on balance outweighs the interests of the data subject. If that is the case you could probably rely on the “legal basis” called legitimate interest and do not need consent or anything like that.

Assuming you are right, that answers part of my question. Yet, I would prefer to see this detailed by an official source.

The other part of my question still remains unanswered. The GDPR limits who qualifies as providing goods/services, but I don't see any limitation on who qualifies under "the monitoring of their behaviour as far as their behaviour takes place within the Union."

It seems like this create a legal liability for every single website with an access log unless it displays a privacy policy.

See GDPR recital 24 (http://www.privacy-regulation.eu/en/recital-24-GDPR.htm):

[...] In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

It appears like monitoring is closely related to profiling, defined in Article 4 as:

‘profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements

If you are trying to eg. predict preferences of data subjects by collecting the logs you are probably monitoring their behavior.

If you are doing this it should be pretty clear to you from the purposes you are collecting information for. Security purposes (such as preventing DDoS attacks) are probably not purposes of monitoring data subjects behavior or profiling.

Thanks for the link.

> potential subsequent use of personal data processing techniques

Not a lawyer, but doesn't every access log with IPs and urls have the /potential/ to be parsed to aggregate a profile of site usage?

Even if you aren't actually doing or intending to do any profiling, the potential still exists.

You may well be correct about all this (and I suspect you are). I'm specifically trying to push back against the assertion: "I really don't think ... that anything in GDPR is hard to understand"

Yes and no. One of the most important principles in GDPR is “purpose limitation” (Article 5.1b):

“Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes“

If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing - that is most certainly in violation with this principle and therefor forbidden.

A “lawful basis” for the marketing purpose will not save you from this principle.

This is also where the public privacy policy/notice plays a role - for the company to be able to prove that the IP addresses where also originally collected for marketing purposes and fair information was given about this purpose at the point of collection.

In terms of GDPR’s territorial scope I guess at the point in time you start to use the DDoS prevention IP logs for profiling you come into GDPR scope. You would also be immediately be in violation of the purpose limitation principle if it is for marketing purposes.

> If a company starts collecting IP addresses for DDoS protection purposes, and then figures out that the data could also be used for marketing ...

Charitably, I think your sentence is just unclear. It seems much more reasonable that someone just thinking or realizing "that the data could also be used for marketing" isn't legally prohibited. Right?

Someone would actually need to use the data, in some concrete specific way, for something illegal to have taken place.

Right?

Yes

And no, GDPR is from my own experience not easy to understand or apply in practice - except for PPT toy problems.

There is a lot of more behind the articles in GDPR since it is partly based on legal instruments on data protection from 1981(!), “Convention 108” and EU legislation from 1995. Case law, opinions from data protection authorities etc. are important.

In general though, I would not be worried about big fines or anything as long as you try to follow GDPR and you are not doing things the data subjects does not want you to do with their data.

In general, the best GDPR compliance test is how it feels in your gut, after learning the principles.

At the point in time you process personal data against the interests of the data subject (for example building marketing profiles, sharing data with third parties w/o request from the data subject, etc) it is time to start worrying and make sure you cross the i’s... GDPR is pretty permissive in general IMO but make sure you know the details.

Predicting and profiling for the purposes of security defense is then illegal? It’s not a legitimate interest?

Then every system implementing fail2ban or email tarpitting (so everyone running Ubuntu or MS exchange in default configs) is automatically violating GDPR.

Never mind the built-in catch-22 where you can’t store any identifiers of persons who have opted out, so you cannot remember they opted out and have to ask them repeatedly!

This law is completely unenforceable, and that is the worst kind of law. It results in inconsistent, politicized and malicious enforcement.

> Sounds like you have a legitimate interest in logging IP addresses for security purposes

European legislation demands this in fact. You have to keep the logs for a few months.

What European legislation is that?

https://en.wikipedia.org/wiki/Data_Retention_Directive

Apparently no longer in effect (overthrown)

Yes, it was. Also, in case it wasn't clear, that rule only applied to communications services, not your average website.

Anyone running a webmail service for example was subject to it.

Same thing for IRC or xmpp servers

It was actually quite broad.

Reply on news.ycombinator.com