3

Joe is a completely novice Web developer who sets up an Apache server on its defaults, which include collection of log files which basically say "this specific file was requested by this specific IP address using this specific client string at this specific time, and the request succeeded/failed." Joe might not even be aware of this logging and might not ever use it.

Joe's Web site is Web 1.0: information published in a form others can read. It has no capabilities for typical users to create an account, log in, or enter data beyond the HTTP GET requests their browser automatically sends when the user navigates to/from/on the site. It doesn't even need cookies.

Joe's server and operations are outside the EU and his primary target audience may be too (e.g. Joe is a local activist in a non-EU country, and the Web site is that of the activist group, or a small nonprofit, or even a local restaurant which might serve ethnic food from a specific European tradition). However, it may be that some people in the EU are interested in what Joe is saying/doing, and visit Joe's web site to read what's posted there.

This page and others I've seen indicates that IP addresses are considered personal information under GDPR. It seems that Joe's server is collecting that data without notice and consent from each user.

It doesn't seem that this site would qualify as "purely personal" in the same way as a personal blog might.

Is Joe in violation of GDPR, just for having posted a simple Web site with an Apache server on defaults?

2

No

Assuming that it is personal data, there are 6 lawful reasons under the GDPR for collecting personal data: you are focusing on no 1, consent; this falls under no 6, legitimate business interest. Notwithstanding, Joe would not be in compliance because he has not identified the legal basis, is not notifying his users and presumably has no procedures in place for dealing with user access requests etc.

However, it isn’t personal data for Joe because, unlike the ISP in the judgement, he lacks the supplementary data (which account the IP address was issued to) that would allow the IP address to be linked to a specific individual.

  • How would he lock up that supplementary data if he doesn't take steps to gain access to it in the first place? – WBT Jun 27 at 15:05
  • @WBT added into answer – Dale M Jun 27 at 20:42
  • The addition says what supplementary data you are referring to, not how he "locks" it up or gains it in the first place. – WBT Jun 28 at 13:29
  • @WBT ah, I see. The confusion is the word should be lacks, not locks – Dale M Jun 28 at 20:55
  • That makes more sense now. – WBT Jun 29 at 1:17
1

First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided.

There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question.

Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.