How are the laws considering storing country details of visitors of my website? (calculated of their ip adresses)

Question

I wanted to add the country of the people who left a review on a website but I was wondering how this regards towards the laws about privacy. I have been doing quite some research into this topic but there weren't any solid answers.

Does anyone know if I am allowed to store the country data of people who post a review? As well as what rules are related to this for different locations e.g Europe and America?

Example data:

Table header       rating | comment | createdOn | countryOfOrigin
Table row          5        "hello"   00-00-0000  The Netherlands

Answer 1

This is a very broad question. Note that the regulation in UE (mainly GDPR) is quite different than that found in USA, itself different than that on many other countries on the American continent.

That said, when talking about privacy, we generally refer to Personally Identifying Information (PII). As such, your conversion of an IP address like 151.101.1.69 to a country, and storing only that, would generally anonymize the personal information (the IP address), what the GDPR calls pseudonymisation.

Do note that this depends on the rest of information you store and the size of the population in which that user gets mixed. Knowing that someone from the US visited your site little information, even if you additionally his first name. However, that same information for a visitor from Vatican City could identify a single individual.

Additionally, even if you weren't allowed to store X a priori, take into account that you can word your website terms for that, so your processing of the information is based on user consent. A line on the terms for posting on your site should be able to clear that up if needed.

Finally, as for the point that Hagen von Eitzen raises about the potential problems of sending the IP addresses to a geolocation service in order to know the country, while you can 'do the paperwork' to handle that properly, I would recommend to simply use an offline database to convert them locally, thus removing that part completely.

Answer 2

In the EU, you have to consider the GDPR. It is perhaps a myth that the GDPR would prohibit a lot, including what you want to do. However, this is not fully true. If your data policy statement accurately describes what you do, and states sufficient reason to do so, and given informed consent by your users, and that they can withdraw their consent, and a few more things - then I guess you can be fully covered. After all, "country of origin" (while being personal information) may usually not be a very helpful thing in e.g. identifying a person, in particular as you do not seem to combine it with e.g. a nickname. (Then again, if a comment by a user reads "I am head of a well-known religious group", you can make an educated guess - but if then the country is either Italy or Tibet, this does narrows things down).

One point that needs to be considered, is that you probably rely on some geolocation service, to which you submit the ip address of your user. With ip addresses being considered personal information, this is quite sensitive, which means that you should not forget to mention this process explicitely in your policy.

I'd still recommend to have an expert help you with all details of the required policy statement as certainly more has to be considered than just the table example from your post (e.g., do you only store the country in your table or do you also display it next to postings).