5.3k VIEWS
Pinterest LinkedIn LINE

Yet another foolish article has been making the rounds.

It claims: “EU: New ruling says IP addresses are also personal data; storing access logs without consent is illegal”1

『EU: IPアドレスも個人情報とする新判断・承諾なしでのアクセスログの保管は違法に』

What nonsense.

The article refers to a report by the major Austrian newspaper “Der Standard,” 2, but as far as I can tell from Google Translate, the original article says nothing of the sort.

First, the subject is the federal government.

And the conclusion is that recording the data in logs is lawful.

An IP address may be a piece of personal information, but storing it is lawful on the basis of legitimate interest under the GDPR.3 It is an entirely natural conclusion when you think about it normally.

For more detail, see this article that I shared on Twitter and Facebook yesterday: 4.

Your dynamic IP address is now protected personal data under EU law https://t.co/5AQb8wNlGp

— OPC NZ (@NZPrivacy) October 20, 2016

If you read the article linked in this tweet, you will readily see that this is an entirely reasonable judgment.

Still, it is troubling that inflammatory, foolish articles like this Business Newsline piece circulate.

 

(In Abu Dhabi)

Footnotes

  1. Business Newsline Japanese edition, “EU: New ruling says IP addresses are also personal data; storing access logs without consent is illegal” (2016/10/20) <http://business.newsln.jp/news/201610201826390000.html> (retrieved 2016/10/21)
  2. Der Standard, “EuGH entscheidet über Speicherung von IP-Adressen” (2016-10-18)<http://derstandard.at/2000046081816/EuGH-entscheidet-ueber-Speicherung-von-IP-Adressen> (retrieved 2016-10-21)

  3. Incidentally, to those in Japan’s business organizations:

    I have been saying this for years, but when revising the law, rather than trying to narrow the scope of personal information (which is impossible given international trends), the proper course is to secure “necessary for the performance of a contract” and “legitimate interest” as grounds on which processing is permitted, just as under the GDPR.

  4. Ars Technica UK, “Your dynamic IP address is now protected personal data under EU law” <http://arstechnica.co.uk/tech-policy/2016/10/eu-dynamic-static-ip-personal-data/>（2016-10-21取得)