We have a user who is being harassed by somebody and on our service, the harasser filled out the user's password reset form.

This created a log entry that essentially says

<Harasser's IP address> initiated a password reset for <User's Username>. Instructions were mailed to <User's Full email address>.

We would like to provide this data to the user who is being harassed so they can pursue it with the internet provider to see if they can figure out who is harassing them.

However, we're unsure if this data is considered somebody else's PII, and thus we cannot give out this information.

Would the harasser have a case against us for giving out their IP address to the user they are harassing?

  • 1
    Privacy law varies. What jurisdiction would the site be located in, or run from? Do you kn ow what jurisdiction the IP address is located in, or at least geolocates to? If so, which one? Mar 11, 2021 at 19:28
  • 1
    How do you know that the IP address you have belongs to a person who is harassing your user? Mar 11, 2021 at 19:29
  • The site runs in the US. The user, and the IP address originate from the same country in the European Economic Area, and are thus covered by GDPR (sorry I failed to mention that in the question, I only tagged the question with that.). The user told us that a harasser had triggered their password reset button, and this log entry is the only instance of that. We really dont know who owns that IP. But we presume its the harassers.
    – Mixologic
    Mar 11, 2021 at 19:33
  • @Mixologic keep this simple - the "harasser" claimed to be the user to carry out the password reset request and you have no evidence that they are not, so in your eyes they are. No judgement necessary.
    – user28517
    Mar 11, 2021 at 19:51
  • Frankly I would say don't bother, it simply isn't useful information, and the likelihood that something bad might happen as a result of you passing along an IP address is just too high. Do a search for problems surrounding IP lookup services. Often times these services will give generic addresses when they can't identify a specific location.
    – Kommissar
    Mar 11, 2021 at 19:52

1 Answer 1


Would the harasser have a case against us for giving out their IP address to the user they are harassing?

No, but it is important that you preserve evidence of the harassment regardless of what you and/or the harassed user decide. A wrongdoer is not allowed to use the GDPR or any other legislation as a shield apropos of his unlawful conduct.

GDPR in its article 6.1(f) permits "processing [that] is necessary for the purposes of the legitimate interests pursued [...] by a third party" (brackets added). The harassed person obviously has a legitimate interest in knowing who is harassing him and purportedly trying to cause him additional trouble.

To be safe, you might want to first ask the harassed user whether he intends to pursue the matter with the ISP, with Law Enforcement, and/or take legal action. Only if he answers in the affirmative, provide the relevant records.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .