Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I started a small experiment. I put up a few servers on digital ocean and I started logging all the failed login attempts. They were numerable.
The dataset after a week is a fun one to play with. I'd love to use it in trainings or even share it on my blog. Is there any reason why I wouldn't be able to do this legally?
The dataset contains a datetimestamp, an ip adress, a username for the attempted login and the location of my server.
There are privacy laws in the EU that could prevent you from doing this, because you can't publish personal information, pursuant to current and new rules (GDPR) effective in 6 weeks. This includes an IP address:
Personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, your posts on social networking websites, your medical information, or your computer's IP address. The EU Charter of Fundamental Rights says that everyone has the right to personal data protection in all aspects of life: at home, at work, whilst shopping, when receiving medical treatment, at a police station or on the Internet.
Whether or not someone will come knocking on your door to arrest or sue you is hard to tell, but the odds are good that somebody else whose computer system you are using will care (because they do business with the EU), and they will make you stop.
