Considering that large sites with teams of lawyers are failing to follow the rules, how does a small site run by a few regular folks supposed to comply?
Journalists are just a lot less willing to criticise the state of the free press than they are to attack companies like Google and Facebook that eat into their collective profits.
It has taken us fairly minimal effort to ensure GDPR compliance. Remember that you don't need automated systems to give users all the information you have or to delete users, it can just be an email form.
This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs
> All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).
Article 4 Point 1 is:
> (1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
It is very far from clear that that covers IP addresses, which tend to be recycled, and would need a police warrant + actual evidence to then map to a specific human
> and Recital 49
http://www.privacy-regulation.eu/en/r49.htm
Failing to see the relevance
> [...] The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant.
https://privacylawblog.fieldfisher.com/2016/can-a-dynamic-ip...
> What does the GDPR say?
> [...] Recital 30 clarifies that "online identifier" includes IP addresses.
http://www.privacy-regulation.eu/en/r30.htm
> (30) Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.
Enter stage left: Address van Six, carrying an EUI64 card in his right hand.
On the face of it, it was more trouble than I could be bothered to deal with at the time, but now I may have to take another look.
Of course, in that situation an argument could be made that the web host is the data controller, but that won't stop people taking legal action against the website's operator.
I am pretty sure that any of the big providers who want to make business in the EU offers the possibility to prevent logging. If not, there is hope that they will soon.
The GDPR doesn't allow individuals to take legal action against non-compliant companies. It allows individuals to report companies to their local data protection agency.
Also you don't have to log the IPs if you don't need them...
https://ico.org.uk/for-organisations/guide-to-the-general-da...
No, that's far from fucking clear, but appears to have been repeated over and over and over again.
https://www.eugdpr.org/gdpr-faqs.html
[edit] faq linked has been changed in the last weeks. How about this one https://ec.europa.eu/info/law/law-topic/data-protection/refo...
Prune the logs.
There you have it.
Much like if you set up your billing software wrong, you could go to jail for years for fraud. Or you could violate a safety regulation and get shut down for months.
Staring at the worst possible punishment is hopelessly hyperbolic.
Also, the claim that you immediately get the maximum fine of 20 million euro for every small detail that you get wrong, is false: https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no... (claim backed up by a book written by an IT lawyer)
Judge's discretion on the fine, and he probably won't like me.
"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
An IP address is an "identifier". However, an IP address does not identify a natural person; you know that, I know that, and even the GDPR knows that.
However, if you start building a map of IP addresses to user real names, or some other form of profile construction, then the IP addresses become personal information.