Does GDPR consent notification apply to access points intended purely for maintenance?

Question

Suppose I have a publicly available interface, intended to be used exclusively by me or my employees for the purposes of maintenance, e.g. an SSH server.

Since I am processing user's IP address when they make a connection, does GDPR require me to notify the user of such an action in, say a banner shown upon accessing the server?

Additionally, am I obliged to treat possible login attemps and the data entered as personal data?

What if the interface processes user data, but its technology does not necesarily provide for a human-readable interaction, such as an ICMP response?

Answer 1

No, you do not need to show a privacy policy just for running a publicly accessible server, as long as any traffic data such as IP addresses is only used as strictly necessary for providing the service requested by the user.

The background here is that while GDPR is a very general law, the ePrivacy directive (ePD) provides more details for telecommunication and information society services, which also includes SSH servers. Per ePD Art 6, traffic data may be used (1) for the purpose of the transmission/service or when the data has been anonymized, (2) for billing purposes, or (3) for marketing or value added services, when the user has given their consent. Information about the processing is only required under ePrivacy for cases (2) and (3), but not for processing that is strictly necessary.

Now the tricky question is under what circumstances you can log (failed) log-in attempts or use tools like fail2ban. One argument is that such measures are strictly necessary to ensure the security of the communication, but these measures are evidently not necessary for performing the transmission in the sense of ePD. There are a few ways to resolve this:

• necessity has to be interpreted more broadly, and security measures are indeed necessary. For example, ePD Art 6(5) mentions fraud detection, without authorizing it explicitly.

• an IP address is effectively anonymized in the sense of the ePD since you do not realistically have means for linking the IP address to any particular person.

  This is a fairly weak argument, but could be supported by GDPR Recital 26 which defines anonymous data. Counterpoint: IP addresses are online identifiers which are explicitly included in the definition of personal data in GDPR Art 4(1).

• an IP address is not just traffic data that falls under the ePD, but also personal data that falls under the GDPR. When the IP address is merely used to make a transmission, it is not processed as personal data and only ePD concerns apply. But when we process it to ban the IP, it is processed as personal data under a legitimate interest. This processing does not fall under any of the categories from ePD Art 6, so that only GDPR concerns apply. These include a requirement to inform the data subject about the processing at the time in accordance with GDPR Art 13, which could be satisfied by displaying a link to a privacy policy in the course of the login process.

  For a legitimate interest argument, it also depends on the expectations of the typical data subject. Since some security measures such as security logs are normal and should be expected, a legitimate interest argument is likely to be strong.

  I think this is the correct conclusion, even though the “it's not traffic data, or at least doesn't fall under the ePD” argument is quite weak. It hinges on the assumption that security measures are not “value added services”. This fits the intent of the ePD, but not the actual definition of value added services.

In any case, you do not need to ask for consent unless you're required to obtain consent e.g. under ePD Art 6(3) or because your processing of personal data relies on consent as the legal basis per GDPR Art 6.

It also has to be noted that ePD has no immediate effect, but has to be implemented by each EU member state in national law. These laws can provide more specific guidance.

Answer 2

Since I am processing user's IP address when they make a connection, does GDPR require me to notify the user of such an action in, say a banner shown upon accessing the server?

Maybe. Can you identify specific users just from their IP address? It seems unlikely, especially if they are merely connecting to the server without being able to log in. In such an instance, it is arguable that you are not "processing" personal data so there is no requirement to notify, etc.

Bear in mind that a lot of automated bots will be port scanning for open SSH servers and they cannot be regarded as "natural persons" for the purpose of the legislation. The number of such bots would seem likely to outweigh the number of natural persons accessing the server in most cases, so it would be sufficient to only show the banner after logging in.

am I obliged to treat possible login attemps and the data entered as personal data?

It depends. If most of the attempts are automated, they are not connected to a natural person, but the actual data entered might count as personal data if users are issued specific credentials. Otherwise, if they log in with a generic account name and password, arguably it is not personal data since it does not specifically identify a person.

What if the interface processes user data, but its technology does not necesarily provide for a human-readable interaction, such as an ICMP response?

I don't know enough about how this works to provide an answer, I'm afraid. I imagine it could be caught by the same provisions, but it would be a lot more fact-specific.

Answer 3

An IP address isn't necessarily personal data.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

If you can use an IP address to identify someone or if you can 'relate' it to someone it's personal data. E.g. in your scenario username jsmith logged in from $ipaddress, you know jsmith is your employee John Smith of 1 Example Street etc, therefore you can relate $ipaddress to that John Smith so it's personal data. But if some unknown entity tries to login from $ipaddress and you cannot identify a person with the IP or relate the IP to a person, then the IP address not personal data.

Presumably you have issued or made available a GDPR or privacy notice to your workers.

Your SSH server doesn't need to notify users that IP addresses are logged.