If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what personal information if for example an inquiry is made. Does that mean that for example an user identifier of some sort should be add to HTTP request logging in server logs?

If yes, wouldn't that be against GDPR as after that a specific user could be profiled and followed? If the server logs gather user IP addresses for security reasons wouldn't gathering also an user identifier cause the gathering of IP addresses being then against GDPR as now the user and the IP can be directly connected?

  • I was also wondering about this "tracking the consent", that's demanded for example in: google.com/about/company/user-consent-policy.html Does that mean then, that we must maintain a database with visitor IP's where we've marked those who consented to the analytics cookies, even if we're not otherwise storing any data? – Zael May 29 '18 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.