Hacker News Reader

Comment by codedokode | Hacker News Reader

I don't really understand why. They just should not collect real names or any other personal information and then they would be fine.

View on HN

Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.

Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation.

For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.

You've been talking to a bag lawyer then.

> if you derive city, region or country from that it becomes personal data

I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address.

Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses.

And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.

Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number.

Quote [1]:

> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);

[1] https://gdpr-info.eu/art-4-gdpr/

IP addresses are PII. Your Apache logs with default configuration already are in violation of GDPR if they log visitor's IP addresses.

Ask for consent and you can store the data. And even if you don’t ask for consent, if you store it for less than 7 days, you are okay.

So at best this is going to be a dumb boilerplate consent message, like the cookie consent popup that's annoying and always trains users to click yes immediately anyway?

Yes, except if you're found to be in violation of how you store or use the data they consented you to use, you're liable. Also they can at any point remove the consent and you need to deal with that.

Please see this comment for a possible solution: https://news.ycombinator.com/item?id=16964318

The best would be to encrypt IP addresses with a key that is regenerated every week. This way you can identify unique visitors over a week but cannot restore their IP address. I hope it will be the default option for popular web server software.

You don't have to keep IP addresses in the log. You could encrypt them with a key that is regenerated every week for example. This way you can identify requests from the same visitor over a week but you cannot restore their IP address.

I think that soon there will be extensions for popular servers that implement something like this. I wish it were the default configuration.

Also I think if IPSs rotated IP addresses among their customers daily it would not be a problem at all.

Reply on news.ycombinator.com