internet european-union gdpr
Contract necessary for the most basic processing under GPDR?
<p>I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or elsewhere.</p>

<p>My partner and I host a number of websites for a range of clients. For some of those clients we consider we do not process any personal data - we set no cookies, use no analytics services, collect no data from the user via forms, and so on. We do however collect IP addresses in our webserver access logs.</p>

<p>It is clear from all I have read (particularly re <em>Patrick Breyer vs Germany</em>) that we need to consider IP addresses as personal data, however I have read (I have sadly mislayed the source) that the CJEU considered there were legitimate cybersecurity interests for recording them (though see comment below).</p>

<p><strong>My query:</strong>
Collection of IP addresses in access logs is noted as normal operations for a web host, and GDPR outlines provisions for doing so to maintain security and investigate breaches. But because IP addresses are personal data, do we now need to create a new contract to outline how we will use this data?</p>

<p><strong>Additional info:</strong>
I see from this resource that Article 11 has a provision for my query:</p>

<p>Article 11 (1) "Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification."</p>

<p><a href="http://www.privacy-regulation.eu/en/article-11-processing-which-does-not-require-identification-GDPR.htm" rel="noreferrer">http://www.privacy-regulation.eu/en/article-11-processing-which-does-not-require-identification-GDPR.htm</a></p>

<p>This though would not exempt us or the Controller from having a contract for the collection of the IP address (unusable as it is for identifying a person, but recognised in law as personal data).</p>

<p>You are correct in your understanding that IP addresses <em>are</em> considered personal data under GDPR because they relate to an identifiable natural person (data subject), even if you don't store/process sufficient information to identify the individual yourselves. The definition can be found in Article 4(1) under the heading 'Definitions':</p>

<blockquote>
  <p>"'personal data' means any information relating to an identified natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"
  (<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> Article 4(1): Definitions, p.33)</p>
</blockquote>

<p>If any of your hosting customers are located within the EU or do business in the EU then as a data processor to them you will need a contract in place with the data controller, or the processor on who's behalf you are essentially sub-processing (your customer or hosting account holder):</p>

<blockquote>
  <p>"3. Processsing by a processor <strong>shall be governed by a contract or other legal act</strong> under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ..."
  (<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> Article 28(3): Processor, p.49)</p>
</blockquote>

<p>Article 28(3) then continues to list out what must be covered within the contract.</p>

<p>Essentially, whilst the processing may be considered minimalistic, low-risk, and perhaps only complying with other statutory obligations, you will still need to ensure you have compliance documentation for GDPR if your organisation and/or infrastructure falls within its scope, and contracts may need to be implemented or updated where they don't currently satisfy Article 28(3).</p>

<p>Specifically with regard to the log data itself (e.g. Apache access/error logs), it sounds like you may be the Data Controller and therefore may need to register with the appropriate supervisory authority, though this is for you to decide - if you choose you are a processor regarding this data, then the controllers need to be kept informed of all processing so they can demonstrate their compliance.</p>

<p>Whether processor or controller, provided you are strict in that the log data is not used for any other purposes (analytics etc), then since the information is recorded and kept solely for information security purposes then in your GDPR documentation's '<em>Information Asset Register</em>' you would state that with regards to the lawfulness of processing of the log data, it is processed for the purpose of a legitimate interest, network and information security: </p>

<blockquote>
  <p>"(f) <strong>processing is necessary for the purposes of the legitimate interests</strong> pursued by the controller or by a third party,
  except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
  which require protection of personal data, in particular where the data subject is a child."
  (<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> Article 6(f): Lawfulness of Processing, p.36)</p>
</blockquote>

<p>Where this legitimate interest is defined in Recital 49:</p>

<blockquote>
  <p>"The processing of personal data <strong>to the extent strictly necessary and proportionate for the purposes of ensuring network and information security</strong>, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), <strong>by providers of electronic communications
  networks and services</strong> and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems." (<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> Recital 49, p.9)</p>
</blockquote>

<p>Under Article 32(1) you would still be responsible for keeping these logs secure, and need to be able to demonstrate your compliance with this:</p>

<blockquote>
  <p>"Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to <strong>ensure a level of security appropriate to the risk</strong>, including inter alia as appropriate:" (<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> Article 32(1), p.52)</p>
</blockquote>

<p>It goes on to detail appropriate measures to take such as encryption. Log information that gets archived/backed-up should be encrypted, and you will need to delete old archived logs once they reach the end of the retention period you have decided upon (e.g. 1 year). There needs to be sufficient length of retention for them to be available to support investigations when required.</p>

<p>With regards to the new '<em>right to erasure (right to be forgotten)</em>' introduced with GDPR in Article 17, you do not need to delete security log information in response to a request to delete personal data, since otherwise the system attackers would ask you to delete the evidence of their activity prior to an investigation being launched!</p>

<blockquote>
  <p>"<strong>Paragraphs 1 and 2 shall not apply</strong> to the extent that processing is necessary: [...] (e) <strong>for the establishment, exercise or defence of legal claims.</strong>" (<a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679" rel="nofollow noreferrer">GDPR</a> Article 17(3)(e), p.44)</p>
</blockquote>

<p>Provided you have already taken care of the appropriate technical and organisational controls, this is probably going to simply be a documentation exercise for you to make sure you have the appropriate paperwork to be able to demonstrate compliance, but you will need to get your contracts updated with your hosting customers so that they are aware of what data is processed for what purposes etc, so that they can ensure their own contracts with their own customers/users (the data controllers) are comprehensive in including all sub-processing that takes place.</p>
