There is an european named A. He goes to a website and tells the website "under my GDPR right to access (given by this one) I hereby ask for my ip address which you logged on september 4, 2018." . Well no company can figure out which ip belongs to whom.What should they do?
asked Nov 16, 2020 at 9:52
-
If you are making a website and are worried about GDPR fines, I'll point out that the law is interpreted by humans, and if this went to court, the judge would probably tell you what they expected you to do, which would also tell all websites what to do in the future to follow the law.– Criticizing Israel not allowedCommented Nov 16, 2020 at 13:48
-
courts are not legal advisors they judge and interpret law many might afford a lawyer but what about those who cannot?– nice life to exist-questionerCommented Nov 16, 2020 at 13:50
-
I'm not saying courts are legal advisors, I'm just saying, they are not these ruthless North-Korea-esque punishment machines. The justice system is for justice; fining a small website a hundred trillion dollars is not justice. I bring it up because everyone seems to be afraid of GDPR fines. The maximum fines are so high, so that they can be high enough to punish Google, Facebook, etc.– Criticizing Israel not allowedCommented Nov 16, 2020 at 14:56
Add a comment
|
2 Answers
Per Art 11 GDPR, the data subject rights like the right to access do not apply if identification is not possible. The data controller is explicitly not required to keep data just in order to be able to respond to later data subject requests. In particular, a data controller might not even log IP addresses. Similarly, the data controller can request additional verification of the data subject's identity per Art 12(6) if there are reasonable doubts about the identity of the person making the request.
However, the data subject rights do apply again if the data subject provides the necessary information to identify them. E.g. indirect identification might be possible if the data subject provides the exact timestamp at which they visited a particular URL, provided that the controller keeps typical logs.
Furthermore, if indirect identification of the data subject would be extremely cumbersome, there might be an argument that the request would be excessive in the sense of Art 12(5) and could be denied – but the data controller would have the burden of proof here.
-
Your answer looks logical. I was also wondering about another case where the data controller asks the ip address (which the user is asking for) to verify that that ip address is theirs. Commented Nov 16, 2020 at 11:23
-
@questioner Which data is reasonable to ask for as identification would depend on the individual circumstances. Asking for the same data that the data subject is seeking access to would obviously frustrate their right to access, and that might not be permissible. On the other hand, if the identity cannot be verified then the access right just doesn't apply. Sometimes, denying a request is the best approach: GDPR compliance must balance fulfilling data subject rights with keeping the data safe from phishing attackers. Everything is a tradeoff.– amonCommented Nov 16, 2020 at 11:29
-
@questioner yes it was a valid request, it just didn't turn up any data. Ideally, the response would explain whether Art 11 applies (i.e. that there might be de-identified data relating to the data subject but you would be unable to link it to the request). In any case the response should inform the data subject of their right to lodge a complaint with a supervisory authority.– amonCommented Dec 31, 2020 at 15:46
-
I meant do we have to record such a request from an unknown person? Commented Dec 31, 2020 at 15:48
-
@questioner You're not explicitly required to keep any records about requests, but you likely want to be able to prove that you handled all requests properly, including this request.– amonCommented Dec 31, 2020 at 16:09
“What IP address is that?”
Since this is A’s personal data, they must be able to identify the particular IP address they used and prove that it was theirs. If they can’t then the company is perfectly within its rights to say, “since you can’t prove it’s yours, we can’t disclose it to you”.
