undefined | Better HN

0 pointsedaemon7y ago0 comments

It doesn't. It says:

> Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address.

Emphasis mine.

I said:

> IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.

0 comments

kasey_junk7y ago

You are making a claim to one of 2 things:

- the ip addresses never uniquely identify someone or

- you have a legitimate interest to collecting this data.

Neither provides carte blanche for collecting IP address.

edaemonOP7y ago

I'm actually saying that both are a requirement for logging IPs in the circumstances being discussed here, but I certainly don't mean to suggest that either would grant you "carte blanche" to collect and log IPs.

kasey_junk7y ago

I suspect that logging IP only for security purposes is fine, but the idea that it is a bulletproof defense is just wrong, we have no idea. Current indicators are that regulators think IP is personal & that legitimate interest defenses are suspect.

AmericanChopper7y ago

I can't see any way in which this interpretation can be valid. You'll always be able to "directly or indirectly" identify people from IP addresses. Just because I don't store IP and identity together, doesn't mean there's not many other ways to identify somebody based on an IP address.

edaemonOP7y ago

How would one identify a person using only an IP address?

If you have "other ways to identify somebody based on an IP address" then that wouldn't meet the criteria laid out by the lawyers.

kasey_junk7y ago

I think the concern of the regulatory agencies (valid or not) is that there are db for sale that allow extremely precise locality information based on IP. Close enough to identify a household, which combined with other data can limit the data to a single person.

KirinDave7y ago

Hello, not a lawyer, but mine said you're wrong.

You might be thinking of this pseudonymization stuff. My advice is not to play with it. Just delete your logs after a month unless you have a demonstrable and immediate security need for them.

edaemonOP7y ago

Wrong about what? I wasn't referring to pseudonymization; we thought that wasn't worth trying after the legal teams laid out what it involved. Log rotation is important, like I mentioned.

j / k navigate · click thread line to collapse

0 comments

kasey_junk7y ago

You are making a claim to one of 2 things:

- the ip addresses never uniquely identify someone or

- you have a legitimate interest to collecting this data.

Neither provides carte blanche for collecting IP address.

edaemonOP7y ago

kasey_junk7y ago

AmericanChopper7y ago

edaemonOP7y ago

How would one identify a person using only an IP address?

If you have "other ways to identify somebody based on an IP address" then that wouldn't meet the criteria laid out by the lawyers.

kasey_junk7y ago

KirinDave7y ago

Hello, not a lawyer, but mine said you're wrong.

You might be thinking of this pseudonymization stuff. My advice is not to play with it. Just delete your logs after a month unless you have a demonstrable and immediate security need for them.

edaemonOP7y ago

Wrong about what? I wasn't referring to pseudonymization; we thought that wasn't worth trying after the legal teams laid out what it involved. Log rotation is important, like I mentioned.

j / k navigate · click thread line to collapse