gdpr website
Are server-logs reckoned as storing of personal data by website (GDPR)?
<p>Well, almost all website have IP logs in "/home/logs/" folder (which is stored by hosting's Apache web-server (or whatever), and not by my site CMS).  Should I state that in our privacy policy? </p>

<p>It follows from case law from the ECJ, e.g. C‑70/10 (28 January 2010) and C-582/14 (19 October 2016), that IP-addresses are personal data.</p>

<p>Since my interpretation of the case law differs from the interpretation offered by @Greendrake, I'll go into the relevant case law in a bit more detail than I did in my initial answer.</p>

<p><strong>TL;DR</strong>: Yes, IP-addresses in server logs are personal data and you need to declare IP-address logging in your privacy policy.</p>

<p>As I said, we need to examine the case law I mentioned in the introduction to find out whether IP-addresses are personal data.</p>

<p>The first of those are <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=115202&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=152181" rel="nofollow noreferrer">ECJ C-70/10</a>.  In this, the court concludes that <em>all</em> IP-addresses are "protected personal data":</p>

<blockquote>
  <p>It is common ground, first, that the injunction requiring installation of the contested filtering system would involve a systematic analysis of all content and the collection and identification of users’ IP addresses from which unlawful content on the network is sent. Those addresses are <strong>protected personal data</strong> because they allow those users to be precisely identified. (my emphasis)</p>
</blockquote>

<p>Then, in 2016, the ECJ ruled in a more narrow case <a href="http://curia.europa.eu/juris/document/document.jsf?docid=184668&amp;doclang=EN" rel="nofollow noreferrer">ECJ C‑582/14</a> specifically ruling on <em>dynamic IP-addresses</em>:</p>

<p>The court goes through a number of deliberations, then concludes:</p>

<blockquote>
  <p>Having regard to all the foregoing considerations, the answer to the first question is that Article 2(a) of Directive 95/46 must be interpreted as meaning that a <strong>dynamic IP address</strong> registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.</p>
</blockquote>

<p>It is very clear from this text that the court does <em>not</em> challenge or invalidate ECJ C-70/10 on <em>static</em> IP-addresses.  The court is very careful, in its ruling to point out its ruling is specifically about <em>dynamic</em> IP-addresses.</p>

<p>So the ruling of ECJ C-70/10 still stands for <em>static</em> IP-addresses, these are always protected personal data.</p>

<p>I believe this case law is summarized in <a href="https://gdpr-info.eu/recitals/no-30/" rel="nofollow noreferrer">Recital 30</a> of the GDPR. This recital lists the identifiers that may make natural persons <em>identifiable</em>:</p>

<blockquote>
  <p>Natural persons <strong>may</strong> be associated with online identifiers provided by their devices, applications, tools and protocols, such as <strong>internet protocol addresses</strong>, cookie identifiers or other identifiers such as radio frequency identification tags. (my emphasis).</p>
</blockquote>

<p>Since it follows from case law that static IP-addresses <em>always</em> makes the data subject identifiable, and dynamic IP-addresses <em>may</em> make the data subject identifiable, I will conclude, based on jurisprudence alone, that:</p>

<p><em>Unless</em> you are able to filter your logs to exclude static IP-addresses. I think you must consider IP-addresses protected personal data under the GDPR.</p>

<p>However, in ECJ C‑582/14, the ruling about dynamic IP-addresses hinges on the controller having <em>legal</em> means to identify the data subject by connecting the IP address to some other data.  The court seems to think that getting access to ISP logs is the <em>only</em> means of doing that.  This is wrong.</p>

<p>In 2015, the Norwegian computer scientist Einar Otto Stangvik </p>

<blockquote>
  <p>identified 78 Norwegians who seem to have downloaded abuse material</p>
</blockquote>

<p>starting only with their IP-addresses.</p>

<p>Stangvik did this while working as a consultant for <a href="https://www.vg.no/nyheter/innenriks/i/PM9V0/this-map-shows-95-000-downloaders-of-child-abuse-pictures-worldwide" rel="nofollow noreferrer">Norway's larges newspaper VG</a>.</p>

<p>I know Stangvik and I am familiar with the methods he used. I've tried them myself, and they work. Stangvik did not have access to ISP logs, he did not do anything illagal, and the 78 natural persons identified only by means of their IP-address, combined with other data the Stangvik had legal access to.</p>

<p>I will not go into details, I will just say this: If you <em>know</em> how to do this, getting to the natural person when you know the IP-address is not difficult or labour-consuming.</p>

<p>To return to the question: It <em>also</em> follows from the GDPR that logging of IP-addresses falls under its definition of "processing".</p>

<p>Your privacy policy should list all personal data personal data that is collected by yourself and <em>third parties</em> ("processors" in the terminology of the GDPR) that you rely on.  Your hosting company is such a third party, and you need to declare the logging of IP-addresses in your privacy policy.</p>

<p>Answer: <strong>It depends.</strong></p>

<p>What it depends on is whether you have access to those logs and whether you practically could identify the real persons to which the log entries belong to — without employing detectives and using forensic science.</p>

<p>Two opposite examples would be:</p>

<ol>
<li>Your website allows user registration where they can provide their
real names. When a logged-in user browses your site, the log entries
they leave can be matched against the user records in your database, which
will make those logs personal data, and therefore this will need to be stated in your privacy policy;</li>
<li>Your website does not allow any input from users. They still leave
log entries with their IP addresses, but you have no practicable
means to find out the real persons behind those addresses. And even
though, in theory, intelligent services could investigate and track
the persons down, this does not make the log entries personal data.</li>
</ol>

<p><strong>Reasoning</strong></p>

<p><a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Art. 4</a> defines "personal data" as <em>"any information relating to an identified or identifiable natural person"</em>. Do IP addresses relate to identifiable persons? They may (as in example 1) and they may not (as in example 2).</p>

<p>Drilling further down, GDPR specifically <a href="https://gdpr-info.eu/recitals/no-30/" rel="nofollow noreferrer">mentions</a> "internet protocol addresses" as data that persons "<strong>may be</strong> associated with", which, again, implies that <em>it depends</em>.</p>

<p>GDPR also <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">explains</a> that the costs and time required for identification can be the line dividing personal and anonymous data:</p>

<blockquote>
  <p>To ascertain whether means are reasonably likely to be used to
  identify the natural person, account should be taken of all objective
  factors, such as the costs of and the amount of time required for
  identification, taking into consideration the available technology at
  the time of the processing and technological developments. The
  principles of data protection should therefore not apply to anonymous
  information, namely information which does not relate to an identified
  or identifiable natural person or to personal data rendered anonymous
  in such a manner that the data subject is not or no longer
  identifiable. This Regulation does not therefore concern the
  processing of such anonymous information, including for statistical or
  research purposes.</p>
</blockquote>

<p>— which relates to example 2 above where one would need to spend substantial money/time to identify anonymous website visitors by their log entries only.</p>

<p>It should also be noted that GDPR is a new law which has not yet had any cases decided on it. Somewhat relevant cases mentioned by Free Radical (<a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=115202&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=152181" rel="nofollow noreferrer">ECJ C-70/10</a>, <a href="http://curia.europa.eu/juris/document/document.jsf?docid=184668&amp;doclang=EN" rel="nofollow noreferrer">ECJ C‑582/14</a>) were decided based on laws/directives that GDPR supersedes. Therefore, those cases cannot be regarded as precedents that judges would necessarily follow when deciding cases on GDPR, but rather just relevant reference/guidance cases.</p>

<p>Another reason why judges would re-build their decisions from scratch rather than follow the above mentioned cases is that technology goes forward very rapidly. While in 2011 ECJ C-70/10 talked about "IP address" full stop, in 2016 ECJ C‑582/14 had to consider the difference between static and dynamic IP addresses, and specify conditions under which the latter can be personal data (<em>"where ... has the legal means which enable it to identify the data subject"</em>).</p>
