And that’s where you’re wrong. Logically? Yes. In GDPR scope? They are personal data.
Guys debating with you is a blast but if you keep downvoting all correct information because it doesn’t match your gut feelings you’ll just become even more of a circlejerk of what you already have here.
You are being downvoted because you are factually incorrect. IP addresses are only personal data if you can identify a natural person from them. You can't do so unless you've linked them to other information. Thus, by themselves IP addresses are not personal information.
> 1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Keyword indirectly. There’s plenty literature regarding ip and gdpr.
“The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address.”
Why would the "website provider" ever be given access to the dynamic IP assignments of an ISP? This information will normally only be given out by court order and/or police request, at least in my native Sweden.
Doesn’t matter. This is what the eu justice court said when it was challenged in court: going from ip to identity is one simple legal request away so it is personal identifyable data. End of the story.
In particular, if the website operator cannot legally access third party information that could be used to identify an IP address owner, or if access to such third party information is “practically impossible”, then the IP address is not personal data from that operator’s perspective.
And that’s where you’re wrong. Logically? Yes. In GDPR scope? They are personal data.
Guys debating with you is a blast but if you keep downvoting all correct information because it doesn’t match your gut feelings you’ll just become even more of a circlejerk of what you already have here.
> correct information
You are being downvoted because you are factually incorrect. IP addresses are only personal data if you can identify a natural person from them. You can't do so unless you've linked them to other information. Thus, by themselves IP addresses are not personal information.
Article 4: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
> 1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
So then all he needed to do is write his name in addition to his IP address in the comment?
> directly or indirectly
Keyword indirectly. There’s plenty literature regarding ip and gdpr.
“The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address.”
https://eugdprcompliant.com/personal-data/
And many others up and including the gdpr preamble
Please stop confusing the readers on the matter.
https://www.jdsupra.com/legalnews/ecj-confirms-dynamic-ip-ad...
Why would the "website provider" ever be given access to the dynamic IP assignments of an ISP? This information will normally only be given out by court order and/or police request, at least in my native Sweden.
Doesn’t matter. This is what the eu justice court said when it was challenged in court: going from ip to identity is one simple legal request away so it is personal identifyable data. End of the story.
Your second link above ( https://www.jdsupra.com/legalnews/ecj-confirms-dynamic-ip-ad... ):
In particular, if the website operator cannot legally access third party information that could be used to identify an IP address owner, or if access to such third party information is “practically impossible”, then the IP address is not personal data from that operator’s perspective.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
There ya go. You sucker can keep downvoting facts as you wish, reality won’t care.