15

I am developing my own website with a blog, portfolio and tutorials, which will be accessible to the public.

As I am the only person who is in charge (my personal site), would I have to oblige to GDPR?

What I want to do is make an administrator panel and track user IP address ONLY if they go to that page. I would then block their IP if there is suspicious activity. I would also need to store cookies to ensure that the person using the administrator page is authorised.

As I understand GDPR make IP addresses personal information. Also, there is the EU cookie law too.

Is the GDPR and Cookie Law applicable to me or not? Also, would I have to make Terms and Conditions?

Improve this question
5
  • 1
    Even If your website does fall under GDPR regulation, which probably depends on its purpose, you might be able to track IP addresses without user consent solely for the purpose of protecting your site against malicious users, since processing personal data is allowed when "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
    – phoog
    Commented Apr 28, 2018 at 19:20
  • @phoog So you mean if I’m processing data only for security, it’s ok in that I don’t need their consent? I’m going to read through it before my site is live anyway. Just want people’s confirmation.
    – iProgram
    Commented Apr 28, 2018 at 19:52
  • 2
    I don't know that for sure. The regulation is young, and any particular case is unlikely to be tested in court for some time. That provision calls for a balancing of competing interests, so there's no way to make absolute statements about some situations.
    – phoog
    Commented Apr 28, 2018 at 21:18
  • 1
    Are you in the EU? As a practical matter, if you're outside the EU and not a multinational corporation, it's probably not going to affect you.
    – Ask About Monica
    Commented May 2, 2018 at 0:07
  • 1
    @O.R.Mapper - I've opened: law.stackexchange.com/q/28582/957
    – Free Radical
    Commented May 17, 2018 at 9:16

2 Answers 2

Reset to default
4

The conditions for lawfulness of processing are spelled out in Article 6 of the GDPR.

As for it being legal for website operators to log the IP-addresses of visitors, this is covered by the following paragraph (also pointed out by phoog in a comment). The paragraph says it is legal to process personal data if

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis)

You are not the only web site that logs IP addresses for the purpose of security. Every web site I've ever worked on - from those controlled by large corporations to tiny NGOs - do this. This security practice will not be impacted by the GDPR (if it were, I am sure we would have heard about it by now).

there is the EU cookie law too

If your website are going to be accessible to European citizens and not only accessible by your friends and familiy, you have to comply with the EU cookie directive of 2002 (a exemption for "personal websites" does not exist).

Improve this answer
2

Art. 2 makes your personal blog feel free to not worry about GDPR:

This Regulation does not apply to the processing of personal data:

c) by a natural person in the course of a purely personal or household activity;

So long as you do not sell goods or services to people in the EU and do not monitor their activity/behavior (read "configure your website analytics, if any, to ignore EU countries") you are fine.

Improve this answer
21
  • 5
    Doesn't that depend entirely on what "purely personal" means in a legal sense?
    – O. R. Mapper
    Commented May 3, 2018 at 15:47
  • 3
    @O.R.Mapper GDPR does not give a definition of "purely personal activity", so judges would apply the Plain Meaning Rule.
    – Greendrake
    Commented May 3, 2018 at 23:35
  • 3
    The German version of the respective GDPR article translates "purely personal or household" as "ausschließlich persönlich(...) oder familiär(...)". These are the same words that have been in use in §55 RStV since 2007. The common interpretation in resources on this topic (just two out of many; only available in German: 1, 2) seems to be that a website ...
    – O. R. Mapper
    Commented May 4, 2018 at 20:44
  • 4
    ... can only possibly qualify as "ausschließlich persönlich oder familiär" if it is exclusively directed at personal friends and family of the author. Following that logic, as soon as a blog might be of the slightest interest to strangers, it is not "personal" any more. Nonetheless, I'd be interested in finding more information on actual court rulings on this topic.
    – O. R. Mapper
    Commented May 4, 2018 at 20:51
  • 3
    This answer is wrong. The definition of "purely personal or household activity" does not apply to a publicly accessible website. The precedence is ECJ C-101/01. (@O.R.Mapper - this ruling may interest you.)
    – Free Radical
    Commented May 16, 2018 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .