IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. After that, when customer logs in again with the same IP address, do I have to log that login with new timestamp? If I don't log every login and when customer asks for GDPR data, I will only be able to provide IP addresses he/she was having with only one timestamp, not subsequent logins' timestamps. Is this a good implementation or wrong/inadequate in terms of regulation/law?
3 Answers
The intention of the GDPR is to minimize the amount of personally identifiable information (PII) you store. So the GDPR never tells you that you have to log certain events. The simplest way to make sure you comply with the GDPR is to simply not store any PII at all. But that might of course conflict with legitimate business interests and with other legal obligations you might have. So when you do store PII, then the GDPR regulates under which conditions you are allowed to store PII, for how long and what you are allowed to do with that PII.
So when you receive a GDPR request from a customer to see their data, then you can say that you only have that one timestamp of their registration, because you didn't log their subsequent logins (assuming this is the truth).
I hope your privacy policy says that you store all that PII on registration and that you have some good arguments why storing that information is a "legitimate interest" of your organization.
-
2We log the IP address of all logins; this is used when somebody complains "not me" and we need to find out where it came from. I can't imagine the alternative being a good idea.– JoshuaFeb 3 at 20:16
-
2@Joshua you still need a written policy of how long is reasonable to keep it. And "indefinitely" is not a legal option. Feb 4 at 11:07
-
2@Joshua: HIPAA allows you to discard logs entirely, right? The "non-modification" means you can't rewrite the 1975 logs to keep record type A but discard record type B. However, if you group your log data by expiry date, you don't need to alter the data. Regardless, a conflict between US law and GDPR just means you need two independent systems. Neither has an exception for the other. (The GDPR does recognize equivalent protection levels, but the US of course falls far short of that level)– MSaltersFeb 5 at 0:10
-
1Also, one of the interpretations is the logs need to be written to WORM media. This also means the records can't be discarded until the newest record on that WORM is ready to be discarded.– JoshuaFeb 5 at 0:26
-
1@Joshua if HIPAA applies to IP addresses of logins, then you are still not required to keep them indefinitely, especially after the subject has died. Feb 5 at 10:02
GDPR means that if you handle personal data, then you need proper procedures and a valid reason for doing so. Customer consent is one valid reason, but not the only one.
- Do you have a technical or business reason to preserve records of every login, including the IP? If not, just don't do it. Data without a good purpose is just a headache for you.
- If you want to log every login (a bank might do so, I guess ...), decide what your reason is. Is it necessary to fulfill a contract? Then the contract is your reason. You have to document that and explain it in your legal boilerplate. But if you want to collect data for better targeted advertising, you probably need the consent of the data subject.
- If you have a valid reason, you also need to decide how long the data must be stored, and implement data access procedures, etc.
If you have customers, then you are a business, and you should hire an expert to advise you. You might be required to appoint a Data Protection Officer for your company, too.
-
8@cagatay117 GDPR does not really interact with such requirements. If there is such a EU/EU member/UK law that requires retaining user IP addresses, GDPR allows you to fulfil that obligation. But GDPR itself doesn't require data processing (see also Art 11, though there can be difficulties in connection with Art 7(1) records of consent). Also note that data retention laws that require blanket retention without concrete suspicion have been repeatedly ruled to violate EU law.– amonFeb 3 at 13:07
-
2@cagatay117, your documentation requirements will vary depending on your sector of industry, and details also vary from country to country.– o.m.Feb 3 at 15:55
-
2@cagatay117
But what if a law enforcement officer asks for a specific login and I couldn't provide that, will this officer tell me this is against law?this is a big speculation on your part. Some businesses do not require logs, and if LEO asks you for information, it may or may not be viable to just not have it ready, depending on the regulations. See e.g. (claimed) "no-log" VPNs law.stackexchange.com/questions/34328/….– LodinnFeb 4 at 1:18 -
3@Lodinn: That's why you really should have that GDPR documentation of the data you store. LEO arrives, you give him the breakdown of what you store and why, and the LEO can then decide to get a court order. But the court can obviously only pick from the list you provide.– MSaltersFeb 5 at 0:16
-
4Data without good reason is not a headache, it is illegal. GDPR states that you MUST NOT retain data that you do not need.– Tom VFeb 5 at 8:26
As already mentioned, GDPR does not require you to collect any data; in contrary - data minimization principle requires one to use as little as possible data. But when you use data you need to have a valid purpose (why you use data? what you want to achieve?) and legal grounds (for example - consent or your legitimate interest in e.g. ensure security of your site). There are though requirements in GDPR like to ensure proof of collecting consent or ensuring security of data processing (all activities related to data on individual). That's where collecting of IP may be needed. From your question, however, it seems that you do not know why you are registering IP addresses and how would you use them. So my suggestion is to stop collecting them until you define the specific need and way you will use them.
