Is a public IP address classified as &quot;personal data&quot; for a third party under EU law? Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in the logs of the web server. Question: are such public IP addresses classified as "personal data" under EU law? Notes: the web site owner has no possibility, by themselves, to link the public IP with an individual the IP address can be linked to an individual by the ISP. This ISP is unrelated to the web site owner there are numerous discussions about the fact that "an IP address is personal data". When digging into the documents, it becomes less clear because one of the conditions for the IP to be PII is, for the one who handles that IP, to have the "legal means" of obtaining access to the information held by the ISP in order to identify the individual. (see here or here)
Apparently, Yes In the ECJ's Breyer decision the final conclusion reads: Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. It is true that in this case the decision was actually under Directive 95/46/EC, not the GDPR, but the GDPR took its definition of personal Data directly from Directive 95/46/EC, so that should make no difference. It is also true that in this case the website in question was operated by the German Federal government, an not by a private individual, or by a private business. A government might have "legal means" to link an IP address with an individual that a private actor does not. However in point 23 of the decision, the Court refered to the IP addresses as: ... stored by the Federal Republic of Germany, acting in its capacity as an online media services provider, ... which seems to indicate that the same ruels were being applied to it as would have been to a private entity. Point 44 of the decision says that: The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46. In point 47, the court says that: ... in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings. This leads the court to point 49, where it says that; Having regard to all the foregoing considerations, ... Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. Nothing in the decision indicates that any particular governmental authority was considered to provide the "legal means" to get an ISP to link an IP used at a particular time to an individual. In this page from Intersoft consulting it is said that: Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible. ... The same also applies to IP addresses. If the controller has the legal option to oblige the provider to hand over additional information which enable him to identify the user behind the IP address, this is also personal data. In this page from eugdprcompliant.com it is said that: A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant. Finally the european Commission says, on this official page: Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. ... Examples of personal data ... an Internet Protocol (IP) address; While the case law is scanty on the point, it appears that the consensus is that IP addresses, even dynamic IP addresses, will be considered to be Personal Data under the GDPR. >
Maybe, but probably not The geographic location of the organisation is immaterial: under Article 3.2: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: ... (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Posts anyone (not just EU citizens) make to Reddit (or anywhere else) while they are physically located in the EU or UK engage the GDPR. Pushift.io is therefore captured by the GDPR and any denial of that is just plain wrong. Given the denial, it is likely right out of the gate that they are non-complient. For example, they are unlikely to provided the required information under Article 14. More importantly, it seems that they have not determined the lawful basis for processing the data under Article 6 - they can possibly rely on the public interest basis (preserving deleted publication is arguably a public interest) or a legitimate interest but that requires a balancing of their interest against the data subject's. That said, the right to be forgotten is not absolute, the reasons that might be applicable here are: The data is being used to exercise the right of freedom of expression and information. The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority. The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
Are my assumptions correct? Yes, this is precisely the sort of thing that would fall under the purview of "the purposes of the legitimate interests pursued by the controller or by a third party", as it fundamentally enables you to deliver the service to the data subject, and its also difficult to argue that "such interests are overridden by the interests or fundamental rights and freedoms of the data subject" given its a fundamental part of delivering the service before any consent can be given. Its not the intention of the GDPR to solely require a direct relationship between the data controller and data subject, its intention is to allow the data subject to control more of the relationship than they did previously - in some cases, that control remains with the data controller, which is why not all of the lawful basis for processing rest on consent. So long as you ensure that the CDN provider has a relevant privacy policy and is identified as a data processor in your privacy and data policy then you are good to go. In my mind, this is similar to the issue of how the data subjects packets get to you from their computer - we aren't including all of the network providers who carry the packets between the data subject and the processor (despite the fact that those providers will have access to much of the same information as the CDN, such as IP address, source, destination etc), even though in many cases we don't know that information (for example which route it will take over the internet). The only difference here is that as the data controller, you know about the CDN and can include it in your policies, so you should.
Companies House itself is exempt from certain GDPR provisions, including Article 17, by virtue of the Data Protection Act 2018, Schedule 2, Part 1, paragraph 5. (That's the Act which implements the GDPR in UK law.) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation. The list is in paragraph 1 of that Part, and has effect under section 15 of the Act. Because the registrar is obliged by an enactment, the Companies Act 2006, to make information available to the public, it's exempt from being asked not to. When Companies House data is processed by somebody else, they do not have this exemption. They are the &quot;data controller&quot; with respect to what they've retrieved (from the API or by scraping) and have freestanding obligations under the GDPR. They may still have other reasons why they are able to retain and process your data, such as a vital interest or a legitimate interest in protecting themselves or others from fraud, and therefore wanting to maintain a list of people associated with insolvent companies. For Article 17 specifically, there are exceptions relating to the public interest, statistics and research which might be invoked. But random websites cannot claim exemption from Article 17 just because the data comes from Companies House. There is nothing in the Companies Act which says that third parties are obliged to mirror Companies House data. This is explained in greater detail in the Companies House Personal Information Charter, which is where I found the citation above. They go on to say: If you have any concerns about company data on third party products and websites, please contact the organisation directly. We’re not able to advise other organisations on UK GDPR compliance, and we cannot advise you on whether other organisations are complying with the law.
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
In the UK it is an offence to cause a computer to gain unauthorised access to any program or data held in any computer (s1 Computer Misuse Act 1990). It seems likely that other European jurisdictions have similar laws. Certainly Germany does: Penal Code 202a data espionage (German text - English translation). (I mention Germany because the linked thread does.) It might constitute theft in the jurisdiction if the finder did not take reasonable steps to find the owner - which may include informing the police of the find. Depending on the jurisdiction it might count as 'treasure' or abandoned property such that the finder is obliged to inform the authorities (the jurisdiction has the presumption of ownership of abandoned or lost property - e.g. Scotland), which then decide what to do with it. Legally speaking it seems to me that, to declare it legal, we have to get over such hurdles. [edit] There seems to be some dispute in the comments that cryptocurrency is subject to any regulation, counts as property, is something of value or is something that is owned and can be stolen, such that the person in the questioner's scenario could be held to account under the law for his behaviour. Aren't they merely numbers? No - plainly they do have value because people trade them with currency and goods and services. The UK's tax authority, HMRC, "does not consider cryptoassets to be currency or money" but sees them as having economic value because "they can be 'turned to account' - for example, exchanging them for goods, services, fiat currency (that is money declared by a government to be legal tender) or other tokens". They are "a new type of intangible asset". Individuals are liable "to pay UK tax if they are a UK resident and carry out a transaction with their tokens which is subject to UK tax". They are liable for "Income Tax and National Insurance contributions on cryptoassets which they receive from their employer as a form of non-cash payment [or from] mining, transaction confirmation or airdrops." (HMRC cryptoassets for individuals) Are they property? Something that can be owned, something that can be dishonestly appropriate (i.e. stolen)? That's the interesting dispute. Recently, the High Court of England and Wales ruled in a bitcoin ransomware-related case that "for the purpose of granting an interim injunction in the form of an interim proprietary injunction ... crypto currencies are a form of property capable of being the subject of a proprietary injunction". In that judgment there is some discussion of the authorities for considering or deciding they are property. ([2019] EWHC 3556 (Comm)) read from para 50 if not the whole judgment. In at least two other cryptocurrency-related cases the High Court treated the cryptocurrency as property. Vorotyntseva v Money-4 Limited, trading as Nebeus.com [2018] EWHC 2598 (Ch) and Liam David Robertson v Persons Unknown 2019. There was also a suggestion in the comments that the police would not understand and would not be interested. But there are several jurisdictions where people have been investigated, arrested, prosecuted and convicted of crimes relating to cryptocurrencies. A simple internet search for bitcoin theft, fraud or money laundering will result in some reports. In any case their interest or lack of it is irrelevant to what the law may say.
There are multiple issues with what you are trying to do, including issues with copyright, personality rights, and data protection. You are trying to use other people's content and likeness for your advertisement. Unless you are certain that you can do this in your relevant jurisdictions, without their consent, this sounds like a very bad idea. At least under GDPR, “but they made it public” is not an excuse. Personal data is personal data regardless of how you acquire it. The GDPR also has a very broad concept of identifiability that goes beyond direct identifiers or PII. If you want to use other people's personal data, you need a legal basis, and must provide them notice about your processing. Consent (informed opt-in) is one legal basis, legitimate interest (opt-out) another. You are suggesting to avoid this by blurring PII, but you may also have to blur other content that is indirectly identifiable. Real anonymization that meets the GDPR's definition is a really hard problem. In some cases, a legitimate interest is able to avoid such problems. E.g. if I make a video with commentary about a Tweet, it would likely be OK to show surrounding personal data like the responses including the identities of the various accounts, to the degree that this is relevant to the commentary and/or necessary for proper attribution. However, that commentary likely has strong protections under freedom of expression. At least from an European viewpoint, a tutorial, demo, or advertisement would not have a freedom of expression argument that would shift a GDPR legitimate interest balancing test in your favour. Instead of blurring almost everything in your video or working on GDPR compliance, content licenses, and release forms, you should consider a different solution: create dummy content just for your videos. You can use your own content, and maybe add a dummy profile.
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.