6

Is it still allowed to have server access log files under the new GDPR? Because of the gathering of IP addresses is not allowed, I can imagine that system operators are in violation of the law in countries where the GDPR is active.

Edit (thanks to HBruijn): "Because of the gathering of IP addresses under the GDPR seems to be not allowed"

Edit: the server log files are to maintain server integrity.

closed as off-topic by ceejayoz, joeqwerty, Greg Askew, Esa Jokinen, Jenny D Apr 25 '18 at 9:54

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    I'm voting to close this question as off-topic because it's fundamentally a legal question. – ceejayoz Apr 16 '18 at 14:23
  • 3
    Your best approach here is a) lawyer or b) Google "GDPR log files". – ceejayoz Apr 16 '18 at 14:24
  • 3
    I'm not voting to close. The scope of this legal question is limited to a very central part of professional sysadmin work, and it is possible to answer to this from purely practical perspective, without actual interpretation of the law. – Esa Jokinen Apr 16 '18 at 16:33
  • 1
    Possible duplicate of Can you help me with my GDPR issue? – Esa Jokinen Apr 18 '18 at 10:24
  • 1
    Is it still allowed to X under the GDPR? where X = have log files. For every X the answer is always: it depends. – Esa Jokinen Apr 25 '18 at 13:21
8

The General Data Protection Regulation (GDPR) is for protecting privacy and giving the control over personal data back to citizens. It's not a list of things not to do, even though there's quite a mythology around it already. Currently working as a GDPR mythbuster (not official job title, unfortunately) I've already seen a lot of misunderstanding, misleading and honest uncertainty.

Selected quotations from Art. 5:

Personal data shall be:

b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; - - (‘purpose limitation’);

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

More important than what is collected that it is collected for legitimate purposes and only used for those. One reason to collect IP addresses in log files might be to comply with the integrity and confidentiality: if the purpose of the log files is to detect and prevent illegitimate use of personal data, then it may be for ensuring the privacy, not for violating it.

Just focus on documenting how and why this data is collected, processed and destroyed after it's not needed anymore. If you don't consider your purposes falls in Art. 6 lawful "necessary for compliance with a legal obligation" nor "necessary in order to protect the vital interests of the data subject or of another natural person", the given consent is always the most safe & clear case.

7

Because of [the GDPR] the gathering of IP addresses is not allowed

That simplification is patently incorrect.

The GDPR provides a legal framework for how personal data may be collected, stored and processed. IP-addresses are considered digital personal data governed by that legislation.

Article 6 point 1 provides 6 conditions that make it legal to process personal data (including IP-addresses) and it is already sufficient if only a single one of those is applicable for your purpose.

So it may well be that the IP addresses in your log files are not a violation.

(You may for instance have consent from your users to collect their IP addresses for a specific purpose.)

Since IP addresses are considered personal data, they have to be treated as such and relevant safeguards have to be taken to ensure their security.

Not the answer you're looking for? Browse other questions tagged or ask your own question.