5

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article 15 GDPR).

If the IP address is the only personal data in the log, a controller has no way to verify that a requesting person is actually the data subject. Even the requesting person’s ISP could only verify that the person is the subscriber (i.e., that the subscriber’s Internet connection had this specific IP address at a specific time), but it’s possible that someone else used the subscriber’s Internet connection at that time (e.g., a family member).

Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?

Improve this question

2 Answers 2

Reset to default
2

Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?

The controller has the right to require proof that the personal data is personally data relating to the Internet subscription belonging to natural person making the request.

The burden of proof is borne by the requester.

However, I can imagine a requester first going to his ISP, requesting a complete timestamped log of all the IP-addresses he has been given at various time, getting it notarized, and then providing the controller with this log to get the matching log entries in the controllers web server logs.

However, I can not see what possible use the data subject would have of making such an access request.

(PS: This should not be a access request hard for the controller to comply with. A one line shell-script using a regexp should do it.)

Improve this answer
4
  • But even if the person gets the info from the ISP: the ISP doesn’t know which person used these IPs, only which Internet connection (and who this connection belongs to). So a controller can never be sure that the subscriber actually was the person who was surfing at that time -- it could as well have been a guest or a family member -- and there is no proof (which the controller could verify) who actually surfed. Right?
    – unor
    Commented May 29, 2018 at 10:33
  • @unor. See updated answer.
    – Free Radical
    Commented May 29, 2018 at 11:08
  • (I’m not sure I understand your edit correctly …) Do you say that the controller should give out the data if the requester is provably the subscriber? Even if the subscriber’s spouse/child/friend could be the data subject (when they used the subscriber’s Internet connection)?
    – unor
    Commented May 29, 2018 at 18:34
  • 1
    @unor a similar problem exists with traffic enforcement cameras: they prove something about the car, but not who was driving.
    – phoog
    Commented Jun 28, 2018 at 13:11
0

IP addresses are "personal data" according to the GDPR.

Wrong.

IP addresses may or may not be personal data, and that directly depends on whether the persons who left those addresses in the log can be identified by the controller/processor at reasonable time/costs (that is, without hiring detectives, data scientists etc.).

If, as you say, "the IP address is the only personal data in the log" then it is not personal data, and therefore the controller does not have to provide anything.

Improve this answer
5
  • 3
    In C‑582/14 the Court of Justice (EU) has already determined that IP adresses are personal data, the GDPR does not change that: Thus, it appears that the online media services provider has the means which may likely reasonably be used in order to identify the data subject, with the assistance of other persons, namely the competent authority and the internet service provider, on the basis of the IP addresses stored.
    – wimh
    Commented May 29, 2018 at 14:30
  • @wimh That was a special case where the means of identifying the IP address owner were indeed available to the online media services provider. In no way does that mean that such means are available at all times. Laws do not directly refer to cases to "change" them. GDPR is a new law and the quoted case is not a precedent decided on GDPR, so judges would rebuild their decisions from scratch.
    – Greendrake
    Commented May 29, 2018 at 22:18
  • 1
    You shouldn't have been downvoted for this answer. C‑582/14 clearly states that an IP address being personal data is contingent on having the means to identify the data subject from the IP address and other data.
    – Lag
    Commented May 31, 2018 at 7:26
  • 3
    @Lag, I did not downvote, check my stats, I have never downvoted on this site. I don't have the "Critic" badge. And having the means to identify the data subject includes going to court requesting if from the ISP. It is not prohibited by law for ISP's to identify an IP address. For example in the case of a copyright violation, ISP's give information about the owner to the copyright holder. Quoting the Advocate General: However, so long as they exist, no matter how restrictive they may be in their practical application, they constitute a ‘reasonable means’, for the purpose of Directive 95/46.
    – wimh
    Commented Oct 2, 2018 at 15:01
  • @wimh I must defer to the A-G, although he seems to be saying any practical and lawful possibility (my emphasis) is reasonable.
    – Lag
    Commented Oct 12, 2018 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .