> IP address is PII, though.

Your premise appears to be flawed in the context of established case law. IP addresses alone are not considered 'personal data' unless you have the capacity to readily add other information to add color. See below:

https://www.whitecase.com/publications/alert/court-confirms-...

> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:

> 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and

> 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual.

> On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD.

The vast majority of entities do not meet the requirements for #2.

Fair point. Pretty much all of my data protection work recently has been with sites that can identify the person, sorry, I let thay context affect what I said.

That said, doesn't this assume the user has a dynamic IP address? You can't easily tell a dynamic from a static, so wouldn't you have to plan for the worst?

Maybe, but firewalling an IP range doesn't actually require logging the specific ips. I don't think gdpr has any teeth for information that isn't actually stored.

> I don't think gdpr has any teeth for information that isn't actually stored.

But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily.

But then the law has already been followed.

Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.

By the way, why is IP so important to this many? The only reason I can think of is browser fingerprinting, but for that, IP is actually secondary. Why even bother storing IP apart from temporary/ephemeral security, say, fail2ban?

Not just IPs, The regulation knows about all of them (including RFID):

Preamble paragraph 30: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

That's not what I meant, I'm curious why people want to store IPs apart from the security applications, which usually only need it temporarily.

You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs with full IPs and source ports for at least that long?

No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.

If you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can potentially correlate to a MAC or subscriber. The police can even pull video of a coffee shop to see who was there during an attack.

Without the time stamp and IP information you have zero chance at attribution during a security event.

PCI and a bunch of other regs require log retention for 1 year or even more for this reason.