> Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address.
Emphasis mine.
I said:
> IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.
- the ip addresses never uniquely identify someone or
- you have a legitimate interest to collecting this data.
Neither provides carte blanche for collecting IP address.
If you have "other ways to identify somebody based on an IP address" then that wouldn't meet the criteria laid out by the lawyers.
You might be thinking of this pseudonymization stuff. My advice is not to play with it. Just delete your logs after a month unless you have a demonstrable and immediate security need for them.
