Let's say one builds a website allowing users to post text content that is publicly available and searchable via the IP address of the users who submitted it. Would the owner of that website be legally obligated to remove that content upon request of any other user that happened to share the same IP address? Also would the answer to this depend on the country of origin of the website owner or the users making the request?
2
-
1There are obviously many scenarios where multiple users can be associated with the same IP. My first question is WHY would someone do it this way to begin with. The next is are you prepared to field legal challenges if you attribute some sort of damaging content to an "innocent" user by virtue of their IP?– jwh20Oct 20, 2022 at 14:10
-
@jwh20 There are many possible applications where information would be associated with specific IP addresses on a website. One example would be iknowwhatyoudownload.com Since IP addresses are usually relatively temporary and cannot in any official way be connected with a specific individual outside of criminal investigations one would think that legal challenges such as that would be quite difficult depending on the jurisdiction.– schquestionerOct 20, 2022 at 14:35
Add a comment
|
1 Answer
What obligations the site operator has, if any, depends on what laws apply to the site operator. That in turn usually depends on where the operator is located, and where the site's users are located. The GDPR, for example, applies to operators who are located in the EU, the EEA, or the UK, or have an "establishment" in that sane area, or that process the personal data (PD) of natural persons located in that same area, provided that they target some part of that area, or monitor the behavior of persons in some part of that area. The CCPA applies to operators who are located in the US state of California, or process the PD of people who are lawful residents of that state. Other data protection laws have different scopes, which vary. But the question is tagged for the GDPR, so let us consider that law.
Under GDPR Article 17 a data subjectn (DS) has a right to request erasure of "personal data concerning him or her" This is true for any data that concerns the person who makes the request, whoever may have submitted it or however the Data Controller (DC, normally the site operator) may have obtained it. However, the request is only valid if one of the six specified conditions applies. One of the conditions (paragraph 1, point b) is that the lawful basis for processing was the consent of the DS, and consent has been withdrawn. another (point c) is that the DS objects to further processing, and there are no "overriding legitimate grounds for the processing."
Art 17 paragraph 3 defines several exceptions where the right of erasure could not apply. For example, under point (a) where the processing is needed "for exercising the right of freedom of expression and information."
Under Article 12, paragraph 6:
... where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
Thus the DC may, and under other provisions should, obtain reasonable evidence that the person requesting erasure under article 17 is in fact the DS whose PD is involved. Simply having the same IP address at a later time would not usually be sufficeint identification for such purposes. The DC is not required to act on a request made by a person whose ID cannot be reasonably verified.
It is in part because of such requirements that it is usual to assign user names/IDs (or allow users to select them) and verify that a person making a request is the holder of the appropriate user name, often by the use of a password. But the GDPR does not require that such a model be used. It does not require that any particular model, or particular technology, be used. But it does require that the DC take reasonable measures to confirm that the person making a request for erasure is the actual DS whose PD is involved. Simply checking that the IP address matches would not meet this obligation.
Would the owner of that website be legally obligated to remove that content upon request of any other user that happened to share the same IP address?
No, not without additional verification of identity.
answered Oct 20, 2022 at 19:28
