28 ms·

If only it was that easy. A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have

• wglb 9y ago
  I don't think it is quite that bad. It is certainly less than going full ISO 27001, and less than a major breach.
• musage 9y ago
  > a continuous drag on developing new technologies Any and all of them? Because of anonymized IP addresses in server logs? I wouldn't even buy that when it comes to the web, but certainly not to mention talking about computers and software in general, or even "tech in general", whatever that would be.
  • aeorgnoieang 9y ago
    What's an anonymized IP address? As others have pointed out, there is a sufficiently small number of IP (v4) addresses that any hash function output of them can be easily brute-forced nowadays. So the only 'anonymous' IP address is the one you never collect in the first place.
• deif 9y ago
  Only without consent from the user. Previously it was an ethically grey area to be logging IP addresses anyway. If you are preventing malicious use, then that is allowed as long as you are not using that data outside of the bounds of the user's consent. If, however, a company is storing IP addresses to identify users without their consent and are found to be specifically targeting them without their consent, then that is a misuse of data. You are right that companies will be paying for this for a long time and it does take effort to comply, but if that's what it takes to protect user data, increase security across the board to prevent data breaches and kill off the players that never should be in the business to begin with then I'm all for it.
  • oliwarner 9y ago
    You appear to be suggesting that "intent" defines the shape of law here, but I really don't think that's the case. By my reading, information becomes personal —and therefore subject to GDPR— when it can be used to identify people. If you've got login timestamps, IP addresses and user records, for legitimate reasons, any other logging that includes IPs is tainted because it takes anybody with that data two minutes to munge them together. Intent, and actual business use-case play second fiddle to the worst-case, or "what could that data be used for?".
    • grabeh 9y ago
      Your intention and how you actually use the data are critical to an entity's compliance with the GDPR. If I am only using IP addresses for legitimate purposes of monitoring/protecting my network then that is very different to using IP addresses to assist in my tracking of users for advertising purposes for example. The classification of data of personal data is likely beyond dispute but you are then under obligations on how you actually make use of that data. Entities should have in place relevant protective measures to ensure that if you have only collected data for a limited purpose, it should not be used for purposes beyond that.
    • TheCoelacanth 9y ago
      Worst case usage determines what information is subject to GDPR, but actual business use-case is what determines what data you are allowed to collect. IP addresses are subject to GDPR, but that just means that you have to have either a legitimate business need for keeping them or to have the user's consent to keep them and you need to disclose to the user that you are keeping them and for how long. You probably do have a legitimate need to keep IP address logs for some period of time to allow troubleshooting and possibly for a longer period of time to allow for fraud detection. As long as you are disclosing to the user that you are collecting that information and are abiding by the retention period that you are disclosing to users, then you will be allowed to collect logs of IP addresses.
    • x0x0 9y ago
      Intent comes into play when you determine the appropriate processing basis; for eg preventing abuse, the basis isn't consent and therefore consent is not required. So GP is partially wrong. If your intent is to use the data for marketing purposes, then you are much more likely to require consent. See LI balancing tests.
• s73v3r_ 9y ago
  "act as a continuous drag on developing new technologies" I don't see this as a bad thing. For far too long, we've not cared at all about user data and privacy.
  • marcusjt 9y ago
    Yes, this shifts things to privacy first, instead of second/never.
• Diederich 9y ago
  > A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense, even if you don’t have a nexus in Europe. Can you expand on that?
  • hanoz 9y ago
    IP addresses are deemed personally identifiable information. All web servers log these by default - before asking users for permission to do so - and are therefore, bafflingly, about to become illegal.
    • OrganicMSG 9y ago
      How does this work out for Git repos and other things with encryption backed histories? If I run a software project and a developer wants an identifying section of a repo back-edited, do I have to edit and rebase the whole repo, and what does this do to the trust in a project that is based on a verifiable history? Also, I can't help but notice that currently there is a hell of a lot of money being bet on immutable public ledgers.
      • Tomte 9y ago
        How it works out? Badly. But you generally cannot build a system that intentionally does not have a certain capability and then successfully claim that laws don‘t apply to you, because your beautiful system does not accomodate them.
      • icebraining 9y ago
        Why are you accepting PII into your software projects' source repository in the first place?
        • OrganicMSG 9y ago
          The simple logical answer to that is that it is clearly impossible to blacklist. The more specific answer is: git config --global user.name "Your Name Comes Here" git config --global user.email you@yourdomain.example.com Also, looking up, you can undo a rebase with reflog, so even editing commits with an interactive rebase may not be enough to purge a git repo of identifiable information that people have entered.
• confounded 9y ago
  Of all the wonderful things that we're capable of as technologists, I think we can figure out a way to strip raw-IP addresses from log-files once we don't need them any more. I'll need to figure out to handle this on the data I'm responsible for at the moment. It's boring and it doesn't help the product, but it's not supposed to. In idlewords' terms, I feel like I'm finally purging toxic waste: http://idlewords.com/talks/haunted_by_data.htm http://idlewords.com/talks/haunted_by_data.htm
  • peterhunt 9y ago
    It's left ambiguous, but it's likely that any aggregate computed from personal data may also be considered personal data (i.e. how many unique IPs you've seen).
    • grabeh 9y ago
      If you are looking to derive aggregated insights from data then you need to be clear on your anonymisation processes and understand whether or not you any derived dataset is capable of identifying individuals whether in isolation or through reasonable means. To me if you are taking a tally of the volume of unique IPs alone that would never be sufficient to identify a person but maybe I don't have the full context?
      • halflings 9y ago
        What you're saying makes sense. Any data derived from PII should considered as PII itself if it can be used to identify users, and even if it cannot be used for that, it needs to be cleared frequently enough such that you don't end up with data derived from information for which you received a deletion request, for instance. In practice, you can achieve this by simply refreshing your derived data frequently (ever ~30-60 days), and for aggregated data k-anonymity is a good way to enforce this privacy constraint. https://en.wikipedia.org/wiki/K-anonymity https://en.wikipedia.org/wiki/K-anonymity
  • sunir 9y ago
    You need the IP records for jurisdictions that require long term retention for law enforcement requests including copyright infringement. So you must delete them and also keep them.
• nrjames 9y ago
  Standard server logs with IP addresses must be disclosed in a privacy policy but you do not have to seek consent for them because you collect them as part of a business critical need to prevent fraud. See Recital 47, which includes the language: "The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned." https://www.privacy-regulation.eu/en/r47.htm https://www.privacy-regulation.eu/en/r47.htm
  • njl 9y ago
    The user can request I delete all of the data related to them without “undue delay”. Are you ready to purge all references to certain IP addresses in your logs? Don’t forget backups. GDPR blows up a lot of assumptions we make about writing software and managing servers. https://www.privacy-regulation.eu/en/article-17-right-to-erasure-'right-to-be-forgotten'-GDPR.htm https://www.privacy-regulation.eu/en/article-17-right-to-era...
    • naicuoctavian 9y ago
      I wouldn’t worry about individuals requesting access or deletion of the Apache logs concerning a certain IP as I see no possible solution for the “reasonable measure to verify the identity of a data subject” against an IPv4 IP and, as per the GDPR, providing data to the wrong person could “affect the rights and freedoms of others” in which case you shouldn’t provide the data.
    • x0x0 9y ago
      The user can request whatever. If you are processing the data via consent, you have to obey. If you processing the data under a different basis, then you may well not; you have to figure out. I hope you like paying lawyers!
    • nrjames 9y ago
      Again, you do not have to if is business critical and used for fraud prevention. You must routinely delete logs before they get too old (60-90 days maybe), but you do not need to take special action beyond that. I’m not saying the GDPR isn’t troublesome, but having spent the better part of the last 6 months combing through the law and interpretations of it, I think the concern over IP addresses in log files that can be used for security and fraud-prevention is unfounded. Data portability requests are likely where it will get onerous and expensive. Even with those, there is flexibility build in to prevent users from repeatedly requesting their data at short intervals.
• envy2 9y ago
  > This is just going to be another way for EU regulators to smack around Google and Facebook. Actually, it's more like a giant gift to Google and Facebook: GDPR borders on regulatory capture, with only the giants really having the resources to comply properly. This will hurt startups and smaller firms far more than it will the big dogs with their armies of compliance lawyers.
  • solipsism 9y ago
    That assumes enforcement will be homogeneous.
    • raducu 9y ago
      I'm sure there will be a lot of hipster-trolls suing left and right, trying to make a name for themselves.
      • beojan 9y ago
        This isn't the US, the law is enforced by governments, not lawsuits.
        • raducu 9y ago
          I lack legal experties, but I'd assume you will easily be able to sue any company and claim they infringe somehow on your rights as stated by this GDPR; maybe I'm wrong. I attended a GCP event and I could practically see the hipsters pupils dilate/mouth foaming as they went in the hisper frenzy "this GDPR is a huuuge opportunity".
          • kbart 9y ago
            You can write a complaint to responsible institutions that then chose how to act (send a warning to violating company, issue them fine, start an investigation etc.) You cannot sue companies yourself, unless you can prove that (big) damage was done to you as a direct consequence of violation, then you can seek compensation via civil lawsuit.
• dcosson 9y ago
  When stuff like this comes up it always seems so weird to me that with all the work that regulators put into this, why can't they at least scratch the surface of providing some specific examples? Of course there are legal documents, and maybe some "for dummies" versions written up about it. But would it be so crazy for these regulators to hire someone who knows something about commonly used open source software and building web apps, to help provide a little bit of actionable technical advice? For instance, the majority of the internet is running on Apache or Nginx, why not have an official, EU-sponsored blog post explaining "here's how to set up a LAMP stack, or nginx and rails on a linux server, that complies with GDPR". Of course they can't cover every obscure language or framework, but it would be a starting point. And it would probably end up a lot cheaper than having to investigate and/or penalize people who didn't read the fine print of the law and/or didn't understand how it translates to actually running software. Because despite how "simple" this post is saying these laws are, there still seems to be quite a bit of confusion on this thread, among smart developers, about questions like whether or not we're allowed to keep collecting webserver logs in the default format or not.
  • LoSboccacc 9y ago
    There’s more to that. Startups now exists as a constellation of services and it’s quite hard to tell what goes into a PIA document and whar not. Say our landing web page contains an intercom chat widget and google analytics tracking. At that point we have collected the user ip at most, which would become sensitive only if connected with data from two other businness entities. What the heck am I supposed to write into the damn thing now?
    • _o_ 9y ago
      Ask your chat provider if he is GDPR compliant, he will provide you the confirmations that you need to add to your page. Regarding google analytics, you are risking getting banned if you feed it with personal data (including ip). https://gdpr.report/news/2018/02/01/gdpr-google-analytics-2/ https://gdpr.report/news/2018/02/01/gdpr-google-analytics-2/ If I were you, I would add my own chat (there is bunch of them on github) and use piwik instead of google analytics. (By the rule of the thumb, for each 3rd party provider, ask them about gdpr compliancy and purge all the data you are not getting user consent - GDPR is retroactive)
• arkh 9y ago
  > act as a continuous drag on developing new technologies Or foster new technologies around privacy and user management.
• belzsch 9y ago
  Web logs are not a punishable offence under the GDPR, if you have a legal basis for retaining those logs and reasonable retention and data minimisation policies. If those are in place and you've documented them, you have nothing to worry about. Why? You have a legitimate interest (one of the six legal bases under the GDPR) to combat fraud and maintain information security. That's the primary reason you have those IPs in your logs in the first place. If you're using those logs for analytics purposes, things get slightly murkier, but if you're just using IP addresses to enrich your log data with GeoIP, you should be fine. You might even be able to get away with more granular third-party databases, but the more detailed you get, the closer you get to profiling (which is not where you want to be, if you want to minimise your legal fees). More to the point, I don't understand all this talk about web logs being illegal. If people have collected and processed personal data without thinking about the whys and wherefores, isn't it just a good thing this makes one think about what one is logging and what it's used for? Granted, IP addresses are far from sensitive (depending on your threat model), but I've seen things in technical logs that make me happy about reliable automated retention policies. Also, granted, it's a hassle - that's the price you pay for privacy. I'd still be glad if nginx et al shipped with more GDPR-compatible defaults.
  • boredatwork 9y ago
    > If people have collected and processed personal data without thinking about the whys and wherefores, isn't it just a good thing this makes one think about what one is logging and what it's used for If people are creating software that burns fossil fuels without thinking about the whys wouldn't it be a good thing to have a law that regulates how we use electricity? Shouldn't an EU regulator have input on whether you can release your new blockchain app? You should be fine if its purpose falls into one of the covered categories... People are creating online communities that enable abuse of members. Do we need statues and regulations to mandate abuse protections in online interactions and punish platforms that allow users to abuse other users?
    • dragonwriter 9y ago
      > If people are creating software that burns fossil fuels They aren't. Only hardware burns fossil fuels, and computing hardware doesn't inherently do so, for the most part, only if you choose to hook it up to a fossil fuel power plant rather than something else; the software isn't the thing directly to address. OTOH, the personal data use you are drawing a poor analogy to is the direct point of concern.
• romanovcode 9y ago
  You need to crawl through all your webserver logs (the zipped ones as well) and remove entries by IP. I seriously don't get what's the huge deal about this. Of course it sucks but it's not THAT hard to implement.
  • naicuoctavian 9y ago
    No you don't. AS per the GDPR I see no possible solution for the “reasonable measure to verify the identity of a data subject” against an IPv4 IP and thus to reliably act on IPv4 related data subject access/deletion requests. Also per the GDPR, providing data to the wrong person could “affect the rights and freedoms of others” in which case you shouldn’t provide the data.
• xxs 9y ago
  >A reasonable reading of GDPR makes standard web server logs (which contain IP addresses) a punishable offense... You need retention policies and if you use the web logs for (let's say) detection malicious behavior or troubleshooting, you are in the clear.
  • moreless 9y ago
    Also, you can keep just a hash(seed + IP address) - enough to uniquely identify user session (so you can debug possible problems) but not enough to pinpoint a specific user. Of course in reality nothing is that simple, but it can be done, and it can be done automatically. I am sure there will be GDPR nginx plugins/configs available soon.
    • xxs 9y ago
      Unless you use IPv6 hashing IPv4 address space is way, way too narrow. Hash+seed is trivial to have the original IP recovered So whoever advises that got no idea how hashing (and collision of the latter) works. (Brute force of few billion hashes in the days of crypto currencies is a walk in the park)
• dralley 9y ago
  Welcome to every other industry, where "breaking things" and doing whatever you want with reckless abandon isn't considered acceptable behavior. It's not like you couldn't say the same thing x1000 with respect to finance laws.