Why You Can't Just Block EU Visitors, EU Customers, or Any EU Traffic Under GDPR

Re:Why You Can't Just Block EU Visitors, EU Customers, or An... by eganist on Sunday May 27, 2018 @02:52PM (#17168450)

"Article 4 (4): ‘profiling’ means any form of automated processing of personal data"

CJEU case law has determined that IP addresses are not considered "personal data" except in certain cases (https://www.whitecase.com/publications/alert/court-confirms-...)

> The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if:

> 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and

> 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual.

> On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD.

The vast majority of entities do not meet the requirements for #2. Therefore, automatic profiling rules could not apply since the automatic analysis being performed is not against personal data.

[ Parent | on HN ]

Re:Why You Can't Just Block EU Visitors, EU Customers, or An... by zerostar07 on Sunday May 27, 2018 @03:05PM (#17168527)

I hope that IPs will stop being considered PII for the same reason. It's much easier to anonymize them at the ISP level rather than doing all these acrobatics.

[ Parent | on HN ]