1

I am reading the definition of "personal data" here https://gdpr-info.eu/issues/personal-data/. My understanding is that GDPR comes into play when information is about personal data.

Let's say there is an app similar to clicky.com. It saves three things about visitors: IP, browser and OS information. The app does not have emails, real names, addresses or other info about the visitors.

If the app is anonymizing IP addresses before saving data, it means that browser and OS info can no longer be assigned to a real person.

In other words, there is no way we can say that this information belong to that particular real "person".

Does it mean that the app is GDPR compliant for this particular purpose?

Improve this question
4
  • Hello! Welcome to Law.SE. Please read our tour page.
    – isakbob
    Nov 14, 2019 at 18:49
  • What do you mean with "anonymizing IP addresses"?
    – wimh
    Nov 14, 2019 at 20:00
  • Anonymizing IP means if IP is 110.25.112.113, it's get changed to 110.25.112.0. This IP does not belong to any human. This is how Google describes it support.google.com/analytics/answer/2763052?hl=en
    – user3219798
    Nov 15, 2019 at 4:25
  • 1
    While this use is likely to be GDPR-compliant, GA does use cookies by default, and cookies require consent under the ePrivacy directive.
    – amon
    Nov 15, 2019 at 5:36

2 Answers 2

Reset to default
1

The app is likely GDPR compliant. However the organization has a remaining obligation, namely that of Art 11.2 GDPR. A user who can show exclusive control of that IP address (i.e. that the IP address uniquely identifies him or her) still has the usual GDPR rights.

It is not necessary to offer these rights via the app itself. Another reasonable mechanism such as a website can be used. After all, establishing that exclusive control of an IP address is hard, especially in the era of Carrier Grade Network Address Translation (CG-NAT).

Improve this answer
0

You would have to look at whether the way you anonymize the IPs. If there is a way to decipher what they originally were, you are not GDPR compliant.

That could technically even included being able to feed random IP addresses into the algorithm until you got a match, if they are not randomized.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .