Can a user request the deletion of their IP address that is stored for moderation purposes? An Internet forum logs their users' IP addresses for moderation purposes (fighting abusive sockpuppetry, temporary banning a dynamic IP address range in case of a spam attack, permanently banning static IP addresses in case of persistent toxic behaviors, etc) An abusive user request the deletion of their IP address from the logs under GDPR This seems to be in an effort to prevent the moderators from exercising the aforementioned tools, so that the user can abuse the forum undisturbed Do I need to comply?
No. Art. 17(1) GDPR lists conditions when erasure can be requested. None of the listed grounds would apply in this case. However, you might have to explain why you process the data (for moderation purposes as you explained above), and why that is lawfully. In particular Art. 5 and Art. 6 need to be taken into account. In your case, processing will be based on Art. 6(1)(f): (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Even if the data subject would be a 9 year old child, the legitimate interests of you and other forum users outweigh the objection of the data subject. Based on Art. 5, there will be a moment when the data has to be deleted. For example 1 year after the last login attempt.
Not all cookies require consent. The current answers are in WP 29 Opinion 04/2012 on Cookie Consent Exemption - 00879/12/EN WP 194. This WP29 Opinion is based upon Directive 2002/58/EC (&quot;ePrivacy Directive&quot;), and not GDPR, which is current law for this matter until other guidelines are adopted pursuant to GDPR or until the awaited &quot;ePrivacy Regulation&quot; is finally adopted. 1. General rules This Opinion states 2 critera for cookie consent exemption: (...) exempted from the requirement of informed consent, if they satisfy one of the following criteria: CRITERION A: the cookie is used “for the sole purpose of carrying out the transmission of a communication over an electronic communications network”. CRITERION B: the cookie is “strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service”. 2. User preferences The first two types of cookies would be, as I understand, for the purpose of remembering user preference in how it interacts with the Website. Such types of cookies can fall under criterion B, under certain conditions. Section 3.6 &quot;UI customization cookies&quot; explains the conditions that such type of cookies have to meet so that the consent exemption can apply, in particular: User interface customization cookies are used to store a user’s preference regarding a service across web pages and not linked to other persistent identifiers such as a username. They are only set if the user has explicitly requested the service to remember a certain piece of information, for example, by clicking on a button or ticking a box. They may be session cookies or have a lifespan counted in weeks or months, depending on their purpose. (...) These customization functionalities are thus explicitly enabled by the user of an information society service (e.g. by clicking on button or ticking a box) although in the absence of additional information the intention of the user could not be interpreted as a preference to remember that choice for longer than a browser session (or no more than a few additional hours). As such only session (or short term) cookies storing such information are exempted (...). The addition of additional information in a prominent location (e.g. “uses cookies” written next to the flag) would constitute sufficient information for valid consent to remember the user’s preference for a longer duration, negating the requirement to apply an exemption in this case If you need to request consent, then WP 29 Working Document 02/2013 providing guidance on obtaining consent for cookies - 1676/13/EN WP 208 contains guidance. 3. Cookie Preference cookie The last type of cookie you mention, being the Cookie Preference cookie, would be, as I understand, only used as a purely technical mean to store and retrieve (transmit) the user's explicit choices preferences, and would most probably fall clearly under criterion A and/or B.
The California CCPA, Virginia Consumer Data Protection Act (CDPA), and the Colorado Privacy Act (CPA) all use definitions of &quot;personal information&quot; (PI) very similar to that used by the GDPR, and the arguments which have been applied to classify an IP address as Personal Data under the GDPR could logically be used under each of those laws. For example this official page gives the CCPA definition as: Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics. Note that IP addresses are not specifically mentioned, nor are &quot;online identifiers&quot; a key term under the GDPR. But an IP address often provides geolocation data, which is mentioned. The April 2020 article &quot;Are IP addresses 'personal information' under CCPA?&quot; from The Privacy Advisor by IAPP says: For many businesses, the collection of IP addresses provides multiple benefits from monitoring website traffic to advertising, tracking and deterring malicious activity. But are IP addresses “reasonably capable” of being associated with or “linked” to an individual or household? If not, do they still “relate[] to” or “describe” a consumer or household? These questions are critical to address, because if IP addresses are considered to be “personal information,” then businesses may find themselves subject to additional obligations under the CCPA or forced to rethink how they handle IP addresses as part of their online business. ... The CCPA’s definition of personal information expressly contemplates including IP addresses. An IP address alone may not allow a business to identify a particular consumer or household; however, in many — if not most — cases, an ISP can link an IP address with a name, home address, phone number, email address and even payment information. ... ... On Feb. 10, the California attorney general issued its first set of modifications to its proposed CCPA regulations. These modifications included the following guidance: [I]f a business collects the IP addresses of visitors to its websites but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information. The article goes on to explore the implications of that proposed regulation, saying: In other words, if the business did not link the IP address to a consumer or household, and the business could not reasonably link the IP address with a particular consumer or household, the IP address would not be personal information. This interpretation aligns with the reality that even if businesses wished to link IP addresses to individuals or households, many would lack the information needed to do so themselves and would be unlikely to succeed in compelling an ISP to do so for them However, the regulation quoted above was removed in the March 2020 draft of the proposed regulations and did not appear in the (PDF) Final Regulations, issued in August 2020. The IAPP article goes on to discuss the ECJ case Breyer v. Bundesrepublik Deutschland in which the Court held that IP addresses were personal information in that instance. The article mentions that: Ultimately, the court held the website provider had the means likely reasonably to tie dynamic IP addresses back to individuals because it had legal means for compelling ISPs to do so. Therefore, it held that dynamic IP addresses collected by a publicly accessible website constituted personal data “in relation to that provider.” What the article does not specifically mention, and several other published comments relying on the Breyer decision do not discuss was that in that particular case the website was operated by the government of Germany, which has legal powers to require any ISP operating in Germany to disclose IP assignments. That means that in that particular case IP addresses were potentially linkable by the Data Controller of the site, in ways which would not be available to a non-government site. There does not seem to have been an official decision under any of these laws, including the GDPR, as to whether an IP address is PI for an ordinary business site. The downloadable Privacy Law Comparison matrix compares various aspects of the CCPA, CDPA, CPA, and the GDPR, including their definitions of PI. In short it is not clear to what extant any of the other privacy laws mentioned in the question or in this answer treat an IP address as personal information (PI), particularly when the site is not operated by a government agency, and has no right to compel an ISP to provide data linking an IP address to a specific user. Future litigation may well clarify this.
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
Yes, their waiver has no legal basis and is invalid under the GDPR. They should have hired a better lawyer. GDPR rights cannot be waived (mrllp.com). The last bit should have been: Therefore, in consideration of my participation in any project, I understand that retaining my name and email address, as described above, does not require my consent and that the right of erasure, as spelled out in the GDRP Article 17 (1) b does not apply. The legal basis for our lawful processing of this personal data is Article 6 (1) f ("processing is necessary for the purposes of the legitimate interests pursued by the controller"). I.e. there is nothing in the GDPR that compels GitLab to erase this information, but their waiver is bogus. Keeping track of individual contributions in a software projects is necessary for a number of reasons, including security (if somebody contributes code that jeopardizes security, you want to audit everything that person has contributed).
Probably not, because you should be in a position to rely on the Safe Harbor provision of the DMCA. Safe Harbor protects service providers who provide open, non-moderated spaces for users to directly contribute content. Safe Harbor means you do not need an army of moderators to inspect every message posted to the site or system. It is essential for sites like Twitter, Youtube or StackExchange to exist. You are not liable for that content if you provide a means for IP owners to report copyright violations, and promptly take down any content which an IP owner reports as violating. You don't need to get in the middle of whether that's really true; there's a mechanism for the user and IP owner to &quot;duke it out&quot; directly at no risk to you. However you must take the required steps. For instance you must register an agent, and respond timely to DMCA takedown notices, which means you must be reachable as per the law. Your designated agent address must be staffed 9-5. Note that the &quot;Designated Agent&quot; can be the same person as the &quot;Registered Agent&quot; that you already must have when you are an LLC or corporation. And you'll want to be an LLC or corporation by the time you get big enough to worry about copyright lawsuits.
The GDPR only mentions cookies once (Recital 30). (It says that cookies are personal data if they are associated with natural persons.) As far as cookies go, nothing has really changed since 2002, and the exception granted in the EU cookie directive Article 5(3) is still valid: This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service. If your site complies with the 2002 directive today, it will be GDPR compliant. All the "EU Cookie Law Compliance" plugins I've checked out let the admin configure the site to comply with the 2002 directive, and most let you choose between implicit consent (which is, and still will be, OK if you or third party services do not use cookies for profiling or to collect personal data), soft consent, or hard consent. The latter is however mandatory if you or third party services use cookies to for profiling or to collect personal data. However, if at least one of your cookies are used for profiling (and if you use Google analytics, you are), or if they are used to collect personal data, the exception from explicit consent quoted above does not apply and implicit consent (i.e.: "continued use of the site amounts to implicit consent to the use of cookies") has never been legal for the site. So while nothing has changed since 2002, there is a lot of misinformation about cookies floating on the Internet, and a lot of sites have their cookie banners set up wrong. You may want to do a new cookie audit for your site to verify that you comply with existing legislation.
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.