Return to Answer

I.e. I think the legal framework I have cited is sufficient to state that their is legal base to conclude that under the GDPR is protected personal data.

However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong.

However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong.

Since interpretation of the case law differs from that offered by @Greendrake, I'll go into this in a bit more detail than I originally intended.

It follows from Recital 30 of the GDPR. This recital lists the identifiers that makes natural persons identifiable:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).

Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable I will conclude, based on jurisprudence alone, that:

However, in ECJ C‑582/14, the ruling hinges on the controller having the legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong.

In 2015 the Norwegian computer scientist Einar Otto Stangvik working for Noway's larges newspaper VG

identified 78 Norwegians who seem to have downloaded abuse material.

I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to.

I will not reveal what methods Stangvik used to identify these 78 individuals starting only with their IP-address, but if you now how to do this, it is not too difficult or labour-consuming.

It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing".

Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer.

I believe this case law is summarized in Recital 30 of the GDPR. This recital lists the identifiers that may make natural persons identifiable:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).

Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable, I will conclude, based on jurisprudence alone, that:

However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong.

In 2015, the Norwegian computer scientist Einar Otto Stangvik

identified 78 Norwegians who seem to have downloaded abuse material

starting only with their IP-addresses.

Stangvik did this while working as a consultant for Norway's larges newspaper VG.

I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to.

I will not go into details, I will just say this: If you know how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming.

To return to the question: It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing".

It also follows from Recital 30 of the GDPR. This recital lists the identifiers that makes natural persons identifiable:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).

To understand what this means, we need to examine the case law i mentioned in the introduction. The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data":

To not beat about the bush: Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR.

I think the legal framework I have cited is sufficient to state that their is legal base to conclude that under the GDPR is protected personal data.

Since interpretation of the case law differs from that offered by @Greendrake, I'll go into this in a bit more detail than I originally intended.

TL;DR: Yes, IP-addresses in server logs are personal data and you need to declare IP-address logging in your privacy policy.

As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data. 

The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data":

It follows from Recital 30 of the GDPR. This recital lists the identifiers that makes natural persons identifiable:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).

Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable I will conclude, based on jurisprudence alone, that:

Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR.

I.e. I think the legal framework I have cited is sufficient to state that their is legal base to conclude that under the GDPR is protected personal data.