I've read the new policy. Are they really disabling all server logs? Maybe that's just me but that seems a bit extreme.
What can be kept for legitimate business interests, security, etc. is quite extensive. Really the key is being transparent about it and making sure that people have the ability to know what is being kept and why.
as per GDPR 6(1) grounds for processing can be (b) performance of contract, (c) compliance with legal obligations (d) vital interests of data subject - which can all cover logging ip addresses and user agents for network security reasons (for a short amount of time) to protect the user, which log files are often used for. (IANAL)
We chose to disable all server logs because we feel that it's the right thing to do.
We felt that our website should reflect the same mantra that we carry along with our products: we don't want your data.
We do not wish to track you. We wholeheartedly believe that our users have a right to a strong degree of digital privacy.
GDPR increases that, but we wanted to go a step beyond for this digital security component of our site.