1

Say I host a web page on my computer, and you visit that site from somewhere in Europe. The web server on my computer will know your IP address, and I can choose to "forget" it as soon as the request is completed (eg. pipe apache logging to /dev/null) or keep them and abide by the GDPR such as responding to SAR's.

However there are a number of entities involved in the process that may, and probably do, keep logs of the transaction. These entities will include my ISP, BT (who provide the to house infrastructure), some number of backbone companies, and your ISP. I cannot access these logs, and given that I think it is a legal requirement to keep logs I think I cannot avoid such logging by choosing a different ISP.

How much of this logging am I responsible for under the GDPR?

Improve this question

1 Answer 1

Reset to default
4

You are only responsible for the data that you collect or process, or data that you direct others to collect or process on your behalf.

You are not responsible for the actions of third parties that may carry out incidental collection or processing that you have no control over - this includes such things as your ISP, backbone providers etc, but if you direct a service provider (eg Cloudflare, Amazon AWS etc) to cache your content and process it on your behalf then you need to include that fact in your data processing policy and link to the providers own data processing policy.

Improve this answer
2
  • I think this answers my question well, but if I could just clarify that the thing that makes a difference is what options I have with my existing provider. Ie. if I turn off all logging I can turn off then I am not responsible for any that I cannot control directly?
    – Dave
    Apr 13, 2021 at 13:58
  • 2
    @Dave, you are responsible for personal data you keep or forward, but not for data gathered by other people. For example, if you use an external log file analysis service and you forward your log files there, they are processing PI data on your behalf, so they are treated as an extension of your business entity (so it's not legal to have Facebook and Facebook Data Processing as separate entities and ignore the GDPR).
    – Simon Richter
    Apr 13, 2021 at 14:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .