You wrote:
As far as I believe, it is permitted under GDPR to record and store non-anonymized web server access logs, as these can be useful for security reasons.
True, Recital 49 GDPR:
The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.
You asked:
My question is whether this anonymization process counts as processing personally identifiable data under GDPR?
IP addresses are personal data in some cases, so yes, you're processing personal data.
Then, these anonymized logs will be fed into an analytics tool to provide stats on unique visitors, page hits, etc.
These are purposes considered compatible with initial purposes according to Article 5.1.(b):
Personal data shall be (...) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for (...) statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
As a matter of fact, you might be required to anonymize the data for those purposes, see Article 89.1:
Processing for (...) statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.
If I were to anonymize the logs and continue to use them exclusively for security reasons, would that change anything?
No, you would be processing data in a manner compatible with initial purposes (ensuring network and information security).
Or does it not matter what I do with them once they are anonymized?
Yes, it does. If you're not using them for "archiving purposes in the public interest, scientific or historical research purposes or statistical purposes" then you're using them for purposes incompatible with initial purposes. You would need to find new legal basis for processing.
does this extra anonymization process on top then take it over the line meaning that consent and a privacy notice would be required?
It depends on what you want to do with anonymized data.
In your case, for security purposes or security and statistical purposes, you don't need the consent and there is no requirement for the privacy notice (but sure, it would be nice to publish one). For other purposes it might be different.
