gdpr privacy
Can we provide IP address data that might not be the user&#39;s data?
<p>We have a user who is being harassed by somebody and on our service, the harasser filled out the user's password reset form.</p>
<p>This created a log entry that essentially says</p>
<blockquote>
<p>&lt;Harasser's IP address&gt; initiated a password reset for &lt;User's Username&gt;. Instructions were mailed to &lt;User's Full email address&gt;.</p>
</blockquote>
<p>We would like to provide this data to the user who is being harassed so they can pursue it with the internet provider to see if they can figure out who is harassing them.</p>
<p>However, we're unsure if this data is considered somebody else's PII, and thus we cannot give out this information.</p>
<p>Would the harasser have a case against us for giving out their IP address to the user they are harassing?</p>

<blockquote>
<p>Would the harasser have a case against us for giving out their IP address to the user they are harassing?</p>
</blockquote>
<p>No, but it is important that you preserve evidence of the harassment regardless of what you and/or the harassed user decide. A wrongdoer is not allowed to use the GDPR or any other legislation as a shield apropos of his unlawful conduct.</p>
<p><a href="https://eur-lex.europa.eu/eli/reg/2016/679/oj" rel="nofollow noreferrer">GDPR</a> in its article 6.1(f) permits &quot;<em>processing [that] is necessary for the purposes of the legitimate interests pursued [...] by a third party</em>&quot; (brackets added). The harassed person obviously has a legitimate interest in knowing who is harassing him and purportedly trying to cause him additional trouble.</p>
<p>To be safe, you might want to first ask the harassed user whether he intends to pursue the matter with the ISP, with Law Enforcement, and/or take legal action. Only if he answers in the affirmative, provide the relevant records.</p>
