2

As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons.

I am looking to implement a log anonymization solution, where IP addresses, user agents and referrers in the logs will be anonymized before being written to disk. Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc.

My question is whether this anonymization process counts as processing personally identifiable data under GDPR?

Since I'm allowed to record the data for security reasons, I don't usually need to ask for permission or provide a privacy notice, etc. However, does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required?

If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything? Or does it not matter what I do with them once they are anonymized?

To clarify, this question is specifically about the 'Processing' involved in the anonymization process. It's not a generic question about whether I'm allow to record IPs or not.

1 Answer 1

3

You wrote:

As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons.

True, Recital 49 GDPR:

The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.

You asked:

My question is whether this anonymization process counts as processing personally identifiable data under GDPR?

IP addresses are personal data in some cases, so yes, you're processing personal data.

Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc.

These are purposes considered compatible with initial purposes according to Article 5.1.(b):

Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1:

Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything?

No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security).

Or does it not matter what I do with them once they are anonymized?

Yes, it does. If you're not using them for "archiving purposes in the public interest, scientific or historical research purposes or statistical purposes" then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing.

does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required?

It depends on what you want to do with anonymized data.

In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.

3
  • Please could you help me to understand this? I don't need consent to collect logs with IP addresses for security reasons. But do I need consent to anonymize this information (including IPs) and then use it for another purpose, such as analytics? Would I need to provide a privacy notice for either of these options? Dec 6, 2018 at 18:54
  • @rubberband876, I've expanded my answer a bit. Dec 7, 2018 at 9:28
  • Thank you for the expand answer, I really appreciate the clarification. Judging by your answer, it's fine for me to record logs, anonymize them, then feed them into a log analysis tool specifically for statistical/analytics purposes without requiring consent or a privacy notice. But if I were to begin using the data for something else (e.g. targeted marketing), then I would need consent. Dec 7, 2018 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .