undefined | Better HN

0 pointsjoering27y ago0 comments

I spent near to $10,000 in 6 lawyers 2 in usa 4 in different european countries and all wrote detailed report for me negating what you just said. IP is one of the most PII identifiable elements of an internet user. Exception is when you can prove such IP is a merely a proxy. please get some other lawyers opinion!!

0 comments

edaemon7y ago

Note that I didn't say IPs aren't PII; I said they don't count as long as you are collecting them for the specific purpose of security and don't have any way to identify the person using that IP. Pretty much by definition that is not PII.

That came from the legal departments from our German, UK, and French entities.

kerng7y ago

You contradict yourself, either its PII or not. Common understanding in the industry is that it is. Purpose of security doesn't change if its PII or not. Although security/auditing might allow to hold on for longer because you need the PII as a feature (which you should be transparent about). For pure telemetry you don't need it, I'd claim.

edaemon7y ago

IPs can be PII under certain circumstances, but not the ones I laid out.

> Purpose of security doesn't change if its PII or not.

Security is the legitimate interest, an important part of collection under GDPR.

1 more reply

kasey_junk7y ago

PII is not the standard for GDPR compliance.

edaemon7y ago

That's correct, but PII is what the person I replied to was talking about.

raverbashing7y ago

Here's your problem, you have 6 lawyers.

If you're too worried about this, remove the last octet from the IP or and/or it with a mask. And especially don't associate the IP with the user (by default you can't find out who's the user only by IP).

j / k navigate · click thread line to collapse

0 comments

edaemon7y ago

That came from the legal departments from our German, UK, and French entities.

kerng7y ago

edaemon7y ago

IPs can be PII under certain circumstances, but not the ones I laid out.

> Purpose of security doesn't change if its PII or not.

Security is the legitimate interest, an important part of collection under GDPR.

1 more reply

kasey_junk7y ago

PII is not the standard for GDPR compliance.

edaemon7y ago

That's correct, but PII is what the person I replied to was talking about.

raverbashing7y ago

Here's your problem, you have 6 lawyers.

j / k navigate · click thread line to collapse