Hacker News Reader

Comment by dmattia | Hacker News Reader

This is a critical thing that so many miss. If somebody has a website that doesn't use any cookies, but does send a POST request to www.bigcompanyanalytics.com/send-user-info with a body containing user-identifying information, then that is still illegal if the user has not consented to analytics (if they are in an area that requires opt-in for analytics).

Cookies aren't really mentioned in GDPR or other privacy laws, folks just latched onto cookies as one area that can track users. But really, all personal data is subject to most of the privacy laws, including outbound requests as well as stored data.

IANAL. But for context from lawyers, see: https://ico.org.uk/for-organisations/direct-marketing-and-el...

View on HN

How does that work given that web servers have request logs that capture some identifying info? You already know some things about the user before you can even serve them the consent popup.

I’m not an expert on this, but perhaps it’s the usage of that data and linking to a person that crosses the line.

A web server’s logs may include the IP and http request they’ve made, but once you start attaching that to an identity instead it might count as data processing.

Storing counts as processing under the GDPR; the definition is in article 4. It's not hard to find.

> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

One can use the “legitimate interest” basis (recital 49 may be relevant here) or “compliance with a legal obligation” for logging.

Does an IP alongside a HTTP request count as personal data?

An IP alone is personal data. Recital 30 should be enough, but it has been asserted time and time again by DPAs and courts. See also: https://commission.europa.eu/law/law-topic/data-protection/r...

Logs are acceptable under the “legitimate interest” basis if you need them to secure your service (GDPR recital 49 and https://www.cnil.fr/sites/default/files/atoms/files/recomman...). In some countries, you may have to retain them for some time: “legal requirement” is applicable here.

Reply on news.ycombinator.com