Logging HTTP requests is allowed not because it contains no sensitive data, but because you have a legitimate interest in logging usage of the web server in order to defend yourself against computer crimes, for example. What you aren't allowed to do is retain these logs indefinitely as if they weren't sensitive.
Your premise appears to be flawed in the context of established case law. IP addresses alone are not considered 'personal data' unless you have the capacity to readily add other information to add color. See below:
https://www.whitecase.com/publications/alert/court-confirms-...
> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:
> 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and
> 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual.
> On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD.
The vast majority of entities do not meet the requirements for #2.
That said, doesn't this assume the user has a dynamic IP address? You can't easily tell a dynamic from a static, so wouldn't you have to plan for the worst?
But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily.
But then the law has already been followed.
Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.
Preamble paragraph 30: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.
Without the time stamp and IP information you have zero chance at attribution during a security event.
PCI and a bunch of other regs require log retention for 1 year or even more for this reason.
No sane western corporation will willingly eliminate an entity about the site of USA out of spite and take a profit hit just because of new PII protocol. Just look at FB, Google and the rest of the advertising companies. They bent over backwards trying to accodomate the law.
But: GDRP will filter out businesses that existed in the legaly grey area because technology was faster than the law in this type of busines competitive advantage features.
Every single blog post had a set of people raging that we were assholes for doing this, but the reality was the cost of compliance just didn't make sense for the MVP. It was high 5 figures in cost which was just too much at the time. If we had achieved product market fit then the obvious move would have been to do that compliance to gain more customers, but we never quite got there.
I doubt GDPR gets to that level of cost, so the ROI looks a bit different. But I still think it's a reasonable decision to say "I simply won't do business in the EU because it costs more than I'll gain". A lot of companies also don't bother to go through the effort of printing the dual language labels required to sell their products in Canada, even though it's a decent sized market close to the US.
Tech, specifically the internet, has grown without regulation for a long time. But that era is over. These kind of decisions are routine in non-internet businesses where distribution, borders, and regulations exist. I suspect we're going to have to think a lot more about this in our work in the future.
That's true for big companies.
The calculation changes for small companies, and really changes for hobby projects.
For small companies one mistake and they could be out of business. So its easier to avoid the problem to begin with.
Maybe, maybe not. It all depends on your business and your market.
We're in the UK. If we'd understood how much trouble the EU VAT rules were going to cause when they came in three years ago, we would have excluded customers from the remaining EU member states rather than adapting our systems and processes to comply -- and it would have been one of the clearest and easiest business decisions we'd ever made.
Given the amount of uncertainty and liability involved with the GDPR, it seems entirely possible that some non-EU services will take a similarly conservative approach.
Considering how many US-only startups I see on HN every day, this is patently false.
Did they? Isn't Facebook's GDPR flow "agree or fuck off forever"? https://techcrunch.com/2018/05/25/facebook-google-face-first...
Two things: they are still operating in EU, and it didn't go well for Microsoft itself when they tried to disobey EU.
So, we'll see how it ends.
Probably not. It would make sense to roll out services on a country-by-country basis, limiting exposure to those where the national data regulator is known. EU lobbyists and lawyers were just granted a massive break.
that's ridiculous, small companies grow by targeting audiences and computing expected future cash flow
the cost of legal action is a risk that affects the bottom line (it also affects reputation, but for new laws, the issue of reputation isn't as relevant because the laws haven't been tested by the society yet, they are fresh laws)
the idea that a corporation is "insane" for estimating the future cash flows and legal expenses for providing services to an audience is comedy
no, that's how a good, well-run, intelligent organization grows
the GDPR represents a risk to the bottom line when services are provided to European customers, and that risk must be factored in; this risk directly affects the corporate financial structure, and investors may have some input in terms of when and how to extend service to the EU
pretending that spite or some petty or small emotional frame of mind is required to apply basic sound financial principles of running a business is bizarre
when running a business, you are expected to win, and winning means not going bankrupt because some psycho lawyer in the EU wants to make money by destroying your reputation, destroying your life, and destroying your business
GDPR gives fuel to psycho lawyers. If you don't want to get sued by psycho lawyers, don't provide services to people who hire psycho lawyers, don't provide service to the EU.
If you have deep pockets and you know the expected cost of fighting off psycho lawyers is less than the expected revenue of providing service to the EU, then it may be time to expand to the EU; you and your investors should both have an understanding of the risks and rewards of expanding service.
Let me repeat: this is not an emotional matter, it is a matter of doing business.
If you aren't storing the data tied to a specific person, you aren't profiling, otherwise "receiving an http request and logging that" would violate the GDPR, which it doesn't.
Second, country isn't pii under the GDPR, the location would need to be more precise to be relevant.
I think blocking the entire EU is lazy, but this is the non-est of nonsense.