Are server-logs personal data (GDPR-related)?

Question

Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS). Should I state that in our privacy policy?

Answer 1

It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data.

Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer.

TL;DR: Yes, IP-addresses in server logs are personal data and you need to declare IP-address logging in your privacy policy.

As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data.

The first of those are ECJ C-70/10. In this, the court concludes that all IP-addresses are "protected personal data":

It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are protected personal data because they allow those users to be precisely identified. (my emphasis)

Then, in 2016, the ECJ ruled in a more narrow case ECJ C‑582/14 specifically ruling on dynamic IP-addresses:

The court goes through a number of deliberations, then concludes:

Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

It is very clear from this text that the court does not challenge or invalidate ECJ C-70/10 on static IP-addresses. The court is very careful, in its ruling to point out its ruling is specifically about dynamic IP-addresses.

So the ruling of ECJ C-70/10 still stands for static IP-addresses, these are always protected personal data.

I believe this case law is summarized in Recital 30 of the GDPR. This recital lists the identifiers that may make natural persons identifiable:

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).

Since it follows from case law that static IP-addresses always makes the data subject identifiable, and dynamic IP-addresses may make the data subject identifiable, I will conclude, based on jurisprudence alone, that:

Unless you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR.

However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having legal means to identify the data subject by connecting the IP address to some other data. The court seems to think that getting access to ISP logs is the only means of doing that. This is wrong.

In 2015, the Norwegian computer scientist Einar Otto Stangvik

identified 78 Norwegians who seem to have downloaded abuse material

starting only with their IP-addresses.

Stangvik did this while working as a consultant for Norway's larges newspaper VG.

I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to.

I will not go into details, I will just say this: If you know how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming.

To return to the question: It also follows from the GDPR that logging of IP-addresses falls under its definition of "processing".

Your privacy policy should list all personal data personal data that is collected by yourself and third parties ("processors" in the terminology of the GDPR) that you rely on. Your hosting company is such a third party, and you need to declare the logging of IP-addresses in your privacy policy.

Answer 2

Answer: It depends.

What it depends on is whether you have access to those logs and whether you practically could identify the real persons to which the log entries belong to — without employing detectives and using forensic science.

Two opposite examples would be:

1. Your website allows user registration where they can provide their real names. When a logged-in user browses your site, the log entries they leave can be matched against the user records in your database, which will make those logs personal data, and therefore this will need to be stated in your privacy policy;
2. Your website does not allow any input from users. They still leave log entries with their IP addresses, but you have no practicable means to find out the real persons behind those addresses. And even though, in theory, intelligent services could investigate and track the persons down, this does not make the log entries personal data.

Reasoning

Art. 4 defines "personal data" as "any information relating to an identified or identifiable natural person". Do IP addresses relate to identifiable persons? They may (as in example 1) and they may not (as in example 2).

Drilling further down, GDPR specifically mentions "internet protocol addresses" as data that persons "may be associated with", which, again, implies that it depends.

GDPR also explains that the costs and time required for identification can be the line dividing personal and anonymous data:

To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

— which relates to example 2 above where one would need to spend substantial money/time to identify anonymous website visitors by their log entries only.

It should also be noted that GDPR is a new law which has not yet had any cases decided on it. Somewhat relevant cases mentioned by Free Radical (ECJ C-70/10, ECJ C‑582/14) were decided based on laws/directives that GDPR supersedes. Therefore, those cases cannot be regarded as precedents that judges would necessarily follow when deciding cases on GDPR, but rather just relevant reference/guidance cases.

Another reason why judges would re-build their decisions from scratch rather than follow the above mentioned cases is that technology goes forward very rapidly. While in 2011 ECJ C-70/10 talked about "IP address" full stop, in 2016 ECJ C‑582/14 had to consider the difference between static and dynamic IP addresses, and specify conditions under which the latter can be personal data ("where ... has the legal means which enable it to identify the data subject").