"Take, for example, my old blog. It has commenting enabled and a standard Apache config (where logs include IP addresses). If I want to comply with GDPR, I have to do a bunch of work around log rotation/encryption, provide tools for old commenters to go back and remove their information, and this is even the simple case that I'm not using any 3rd-party analytics."
If it is a company. Yes, it will require more work. That is the nature of regulation, but the demands placed on companies are not unreasonable in any way. I would place it on the same level as stores being required to provide receipts, or restaurants being required to clean the kitchen. It certainly was easier when they didn't need to do that, but don't we agree it's an reasonable burden to place on businesses to guarantee an acceptable level of service?
Restaurants being subject to local laws around hygiene makes sense. It would be far stranger for restaurants to be subject to health codes from across the world just because tourists occasionally visit.
I had no say in GDPR but am forced to comply, despite the overheard it entails without any actual benefit to user privacy (in my case).
Also, you can keep logs (with IPs) if the purpose of the log is to prevent abuse. If you are only keeping the log on because it was the default, that is a bad reason to keep them, and is not in compliance with GDPR.
If you are keeping the log because you are selling the data to Facebook for data analysis, and are sad because you have to turn them off for EU citizens. I’m not sorry that you are forced to comply.
It's not strictly personal, in the sense that I post technical content which sometimes leads to me being hired for consulting engagements.
> If you are keeping the log because you are selling the data to Facebook for data analysis, and are sad because you have to turn them off for EU citizens. I’m not sorry that you are forced to comply.
I honestly cannot tell if you are trolling or not.
Do you truly think Facebook has a program where I can sell them my Apache logs of a few daily visitors?
Yes, it would be more challenging, and inconvenient, and probably a massive pain in the ass not to log IPs by default, but if the end result is a weakening of the power of modern social media companies (and political and law enforcement agencies) to exploit people's data for nefarious ends without consequence, then society as a whole, and the web, benefit.
Mind you, I don't necessarily believe GDPR is the solution, or that logging IPs is unreasonable, but I do welcome the conversation people seem to be having about who owns their identity.
If you're using a CMS then it's going to be type the username and hit "delete all comments"; maybe WordPress et al. do this already.
With a small blog the administration of that is going to be facile, surely.
And by the way, most blog comment systems don't require you to create an account before commenting. So this "have them post a comment using their credentials" wont work anyway.
Personally, I don't even think people should have the right to go back and delete a comment from years ago, which might have started a whole interesting discussion. But the EU requires that I think through such a system, including finding a way to identify them as the commenter and purge their PII from all logs/backups/caches as well.
If the blog is purely personal the GDPR does not apply.
https://ico.org.uk/media/for-organisations/data-protection-r...
> The GDPR does not apply to certain activities including processing covered by the Law Enforcement Directive, processing for national security purposes and processing carried out by individuals purely for personal/household activities.
And if GDPR does apply you only have to do the extra work if the IP addresses can be used to identify a natural person. Note here "can be", not "is".
> Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data. The more expansive definition provides for a wide range of personal identifiers to constitute personal data, reflecting changes in technology and the way organisations collect information about people.
http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
> (26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
And article 4
1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
IANAL but for me this doesn't sound like a blog, open to the public, maybe even with a public commenting system, would be freed from the burden of the GDPR.
IPs "can be", not "is" personal data
It doesn't help you that IPs are not always personal data, as soon as they can be, you have a problem if you store them.
Where's the burden? Only collect the data you need; tell people what you're collecting and why; only keep it for as long as you need; keep it safe.
These are not burdens.