Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever I have a small static personal website, where I publish some technical articles and my personal CV. Do I need to include a privacy-policy if: There are no (third- or first party) tracking services used There are no IP logs kept There are no comment fields or other features where users can enter information to be saved I do not publish information about specific persons in the articles To provide an idealized model, assume that the server is configured to forget ALL state after serving a HTTP request for the website. Nothing about the request is saved. Not even information like traffic statistics that would confirm a request happened at all. An additional concern would be that website is hosted on a root-server with a German provider (Netcup). Do I need to inform people that this provider could theoretically collect data (still nothing more than IP addresses with timestamps and encrypted TLS traffic)?
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. If the website terms which you agreed to don't include this data matching, then that processing is not lawful. The rest of Recital 50 is relevant and worth quoting in full: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. It seems to me that an anonymous account could reasonably expect that the &quot;further processing&quot; of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website. Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.
Disclaimer: Links are in German. My German is quite rough. Quoted translations provided by Google Translate. Turns out the question "Do I need an Impressum?" is complicated. I'll start with examining the case for companies, then work down to the average private citizen. Impressum requirement The requirement for an online Impressum comes from the Telemediengesetz (TMG) &sect;&nbsp;5: 1) Service providers are obliged to keep the following information readily available, readily accessible and constantly available for commercial, usually paid telemedia: the name and address under which they are established [...] Applicability based on country of origin The applicability of the TMG is described in &sect;&sect;&nbsp;2a, 3. Thankfully, there is a 2013 court case focused on these sections, involving an Egyptian company marketing cruises and not having a proper Impressum on their website. Also thankful is that law firm mth Tieben &amp; Partner summarized this decision, because as it turns out, I cannot read judicial German. Summarizing their summary, &sect;&sect;&nbsp;2a, 3 sets the standard that the required information is based on a country of origin principle (Herkunftslandprinzip), where if that country of origin is Germany, § 5 applies. However, this principle is rooted in EU directives, and as such is not applicable to non-EU countries. For these, the law falls back on the older principle of market location (Marktortprinzip). If the non-EU company advertises in Germany and thus participates in the German market, then it must have a valid Impressum. I'll note that, the TMG considers Germany to be the "country of origin" if the company is either registered in or has significant operations in Germany (see the given sections for specifics). This is not the same "country of origin" as is found in copyright law. Applicability to private website hosts As it turns out, an Impressum is not required for private non-commercial websites. However, as pointed out by this Anwalt article, the wording of the TMG makes it such that omitting an Impressum may often be illegal. In particular, the definitions section of the TMG provides very broad definitions of "Service provider" (Diensteanbieter): Service provider shall mean any natural or legal person who provides his own or third-party telemedia for use or provides access to use; in the case of audiovisual media services on demand, service providers shall mean any natural or legal person who effectively controls the selection and design of the content offered, and "commercial communication" (kommerzielle Kommunikation): Commercial communication means any form of communication which serves the direct or indirect promotion of the sale of goods, services or the appearance of an undertaking, other organization or a natural person engaged in trade, trades or crafts or a liberal professions; [...] Conclusion In terms of variables like the one you suggest, the proper "variable" for companies is the country of origin. For private web hosts, I would argue that residency is the closest analogue to country of origin as defined in TMG &sect;&sect;&nbsp;2a, 3. Location of server doesn't matter, and I don't think citizenship does either. With that in mind, the values would be: Germany: Required EU: Not required Rest of world: Required if advertised/directed in/towards Germany. with the caveat that truly private non-commercial websites never require an Impressum.
In the question, you write: The GDPR requires consent of the subject for collection or storage of personal data (in this case, IP addresses in a log file). No, it does not. To quote Miss Infogeek: GDPR DOES NOT MAKE CONSENT A MANDATORY REQUIREMENT FOR ALL PROCESSING OF PERSONAL DATA. Consent (Article 6 (1)a) is indeed one of conditions that can be used to comply with the GDPR requirement that processing must be lawful, but it is not the only condition available to the controller to ensure lawful processing &ndash; there are alternatives (before the list of conditions it says that "at least one of the following" must be satisfied). All the conditions for lawfulness of processing are spelled out in Article 6 of the GDPR. One of alternatives are Article 6 (1)f. It says says it is legal to process personal data if processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. (my emphasis) As noted in the question, logging IP addresses for the purpose of security is an extremely widespread practice. It is a legitimate interest to comply with standard security practices. It is the default, and most (all?) web-sites do this. I.e. it is legal to do this without consent (if this is not the case, I am pretty sure the outcry had been heard all over the Internet by now).
When you make a request based on the GDPR, Art. 12(6) GDPR applies. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. As you can see, this only applies when the data controller (Blizzard) has reasonable doubts about your identity. If I understand it correctly, Blizzard provides services (games) which requires you to login with a username and password. So they have no doubts about your identity when you use their (paid) services with just a username and password. So there should also be no reasonable doubts when you make other requests when you are able to login to their website. A copy of your government ID seems unnecessary. Recital 57 also confirms that identification does not require a government ID: Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. A copy of your id, includes a photograph. The photograph could show health, religious, racial or ethnic information. That kind of personal data has much stricter rules defined in Art.9 . Most governmental IDs contain a national identification number. EU Member States can limit processing of those identification numbers even further. For example in the Netherlands processing of the identification number is only allowed when a specific law exists. So Blizzard is not allowed to process a Dutch national identification number. There are also ID convers] which hide sensitive information like document numbers and photographs in case you do need a copy of an ID. Also note that identification is only possible by comparing existing personal data with the provided personal data. I assume you did not provide a copy of your ID when registering. So many things which are shown on the ID do not make sense to sent to Blizzard. It does not know your place of birth, so it cannot verify it. Art. 5 requires 'data minimisation' for personal data. So they are not allowed to process more data than required. So you also do not need to send you more data than required. You should get an answer on your request within 30 days. However, since you ask to delete your account, the answer also might be that they will deny your request. They have to explain why they will not delete your account.
Think of a website that has gives no option for the users to delete what they have posted -but still the users can delete their account completely. That's easy - this is exactly how all StackExchange sites (including this one) work :-). See for example: How does deleting work? on meta.SE. Is it against the right to erasure mentioned here as a part of GDPR? No, it is not (otherwise StackExchange would be in rather big trouble). The "right to be forgotten" is subject to limitations. Most importantly, it only applies to personal data. Personal data is defined as (GDPR, art.4): any information relating to an identified or identifiable natural person (‘data subject’) If what you posted contains no personal information about you, it is not "relating to" you. The details are complicated (as usual, see e.g. The GDPR: What exactly is personal data?), but "personal data" is things about you (your name, your address, your sexual history, maybe even your IP address). On the other hand, if someone asks how to solve a programming problem, and you write an answer explaining what API to call, that answer is not personal data. In addition to that, even personal data may be retained if the data controller has a need to retain that information. This is also covered in article 4. For example, the controller may retain information "for the establishment, exercise or defence of legal claims" - otherwise you could buy something online without paying, and then ask the seller to forget about your purchases so they cannot collect the outstanding payment. So, in summary: A website will need to allow users to delete or hide personal data that they posted - such as their user profile information, or personal information in their posts. That does not mean they are allowed to delete entire posts - it is enough if personal information is redacted or anonymized. The website may be allowed to retain that information (hidden) if they can show legitimate interest - for example billing information, or posts that are the subject of a lawsuit. The StackExchange network, for example, covers this by allowing users to: disassociate posts from their account delete their account entirely (thus effectively disassociating all posts from personal information) asking a moderator for redaction of personal data
It may be legal or it may not For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.
There’s no definitive list of what is or isn’t personal data, so it all comes down to properly interpreting the GDPR’s definition: ‘[P]ersonal data’ means any information relating to an identified or identifiable natural person (‘data subject’). — Article 4(1) In other words, any information that is clearly about a particular person. But just how broadly does this apply? The GDPR clarifies: [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. — Article 4(1) This means that because you say that coordinates and anticheat logs are linked to the cheaters ingame username and unique id, if there is a record of who that username and/or unique id belongs to, even if it is just an IP or email address, it is considered personal data because the information relates to an identifiable natural person. Personal data includes any data which can be linked to information where a person can be identified From CommentsIf the online username and unique id is not linked to the actual human (no stored real name, no home address, no IP), can the natural person actually be identified? The records and anticheat logs are linked to the unique id and username, however the unique id and username are (from my POV) not actually linked to the real human Only you can answer that question as it stands because we have no access to your data. From what you have told us, even though the coordinates and anticheat logs are linked to the cheaters ingame username and unique id, that alone doesn’t fall under the GDPR’s scope of personal data, as, in all likelihood, the usename and unique id could relate to anyone in the world. The issue comes if elsewhere you have a record of the person's name, IP, date of birth etc. which when combined with the anticheat logs could link that data to identifiable people. You might think that someone’s name is always personal data, but it’s not that simple, as the UK’s Information Commissioner’s Office document what is personal data (PDF) explains: “By itself the name John Smith may not always be personal data because there are many individuals with that name. However, where the name is combined with other information (such as an address, a place of work, or a telephone number) this will usually be sufficient to clearly identify one individual.” Note: A name which is much less common could be personal data as the likelihood of it relating to others deminishes. John Smith is a common name all over the UK, but what about a particular polish/czech/hungarian/french.... name (let's say) living in Nottingham, UK? What is the likelihood of another person of the same name in Nottingham, UK? Add a middle name or double barrelled surname, and it becomes even more likely that it is personal data. If you’re unsure whether the information you store is personal data or not, it’s best to err on the side of caution. This means making sure data is secure, reducing the amount of data you store, collecting only as much data as necessary to complete your processing activities, keeping data for only as long as it meets its purpose, and ensuring only authorised people are able to access the data.