0

I want to have a website where I publish my own articles.

When a user requests a webpage, I receive an HTTP request from their browser, which contains the IP.

Now, for a split second while the website processes the request, it stores the IP. This is cleared immediately after sending the response (and the webpage is sent to a user).

Suppose there is no other kind of IP logging for my website, nor any user data collection/tracking.

Does this constitute personal data processing? If so, do I have to register as a "Data Protection Officer"?

Also, is any website able to comply with GDPR, seeing that any webpage visit triggers the processing and response of an IP address?

There is an exception "for journalistic purposes or the purpose of academic artistic or literary expression" (Article 85 in the GDPR). However this relies on the member states' law.

Edit: Also, there is an exception for personal activity: Article 2, paragraph 2. (c): "by a natural person in the course of a purely personal or household activity" - This would mean that if I do not publish the IP, it's "personal". But replying to an IP would technically imply that I send the IP to the ISP, and routers along the way, so I'm not sure if it's "personal".

  • IP address is only personal data when you can, using reasonable means, identify the person. Nowadays most users' IP addresses are shared behind NATs and are very dynamic, which makes the difficulty of identifying the owner way too high to consider the IP personal data. Just relax. It is not personal data nowadays unless you collect other personal data (which you do not). – Greendrake Mar 27 at 23:42
  • @Greendrake That's incorrect. IP addresses are a prime example of personal data. The ISP has a record of your IP address at any time (even with dynamic IPs and IPv6 privacy extensions), not to mention all the trackers that link your IP address to an online identity, and so it easily qualifies as "data relating to a natural person". It doesn't matter if you are collecting the data that allows you to link it to the real world identity yourself or if someone else does it. – Stefano Palazzo Mar 29 at 7:28
  • @StefanoPalazzo tracking a person by IP address, even for the ISP, is a costly forensic job: there cannot be certainty that the corresponding ISP account owner is the person. It could be anyone using that account holder's internet connection. The cost and time required are way too high than the threshold for "reasonable means" in the context of GDPR. If you see cases where IP was held personal data those were special circumstances not applicable widely, let alone nowadays. – Greendrake Mar 29 at 8:43
  • @Greendrake If you could show that the associating of the identity by the ISP was either impossible or illegal, you might have a point. But this is not the case. You can read about a relevant judgement of the ECJ here: ECJ Declares IP Addresses are Personal Data. If your argument is that some IP addresses are impossible to trace, that's true, but some are easy to trace, and therefore the whole dataset should be considered personal data. – Stefano Palazzo Mar 29 at 11:47
1

If you are processing the IP address in order to respond to the HTTP request, you are definitely processing personal data[1][2][3]. The fact that you are not keeping any logs would be considered a technical measure to reduce the risk associated with processing (and you should definitely do what you can to reduce that risk, including avoiding processing or storing data unless it's actually necessary).

In GDPR, processing needs to have a legal basis (Art. 6 GDPR). In this case, you would probably chose Art. 6(1)(b) (if you have or are preparing to enter into some kind of contract with the data subject and that's why you are processing their data), or Art. 6(1)(f) (your legitimate interest as a controller) as the legal basis for processing the IP address (also don't forget about the all the headers sent by the browser).

So by figuring out what your legal basis is for each category of data, you can process data lawfully and be compliant.

On the question of the data protection officer: a DPO is someone who is appointed by you to independently protect the interests of the subjects (you can't do it yourself as that would be a conflict of interest). However, in your case, there is a good chance that you don't need to appoint a DPO. (See Do we need to appoint a Data Protection Officer?

The derogations of article 85 probably don't mean that you can ignore GDPR for these purposes, but merely that there will be special provisions (for instance, you can probably not use your right to object to the processing of your data to prevent a newspaper from writing an article about you).

The question of whether this is "a purely personal or household activity" is a little bit more complicated. Recital 18 says:

(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.

If you (or your blogging software) were to integrate Google Analytics for instance, I would say you are quickly entering the realm of "potential adverse effects" on the data subject, and so you should not rely on this as your legal basis for ignoring the GDPR (especially as it would not be super difficult to comply).

In my estimation, if you are practicing anything that could be called journalism, you are very likely out of the scope of the household exception.

Otherwise it's definitely possible to argue that blogging is a personal activity. You should make sure that:

  • You are not doing anything that could be considered commercial or organised
  • You don't disseminate personal data (this may not be so easy)
  • You don't pose a risk to the rights and freedoms of the reader (i.e. you don't put their privacy at risk in any way)

Alternatively, you may chose to spend the time (and money) to create a privacy policy and be compliant even though you don't necessarily have to.

Sources:

  1. http://www.privacy-regulation.eu/en/recital-30-GDPR.htm
  2. https://eugdprcompliant.com/personal-data/
  3. https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal-data/
  • Downvoted. Really getting tired of this widely spread myth that IP address is necessarily personal data. – Greendrake Mar 29 at 8:44
  • I've added some of my sources for your consideration. – Stefano Palazzo Mar 29 at 11:56
  • Read the ECJ decision article you linked. A personal website owner does not have "legal means" to fish identity data out of the ISP. He is not a government. – Greendrake Mar 29 at 15:28
  • 1
    It says "it is not required that all the information enabling the identification of the data subject must be in the hands of one person." and later, talking about the fact that for cyber attacks, there exist legal channels for sharing this data between the ISP and the provider, "Thus, it appears that the online media services provider has the means which may likely reasonably be used in order to identify the data subject, with the assistance of other persons, namely the competent authority and the internet service provider, on the basis of the IP addresses stored." – Stefano Palazzo Mar 29 at 16:02
  • The keyword is the online media service provider. You seem to be missing the point that, in this judgement, ECJ was focused on a specific online services provider which indeed had "the means". In no way does that citation apply to any/all websites. – Greendrake Mar 30 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.