Is the IP personal data for the GDPR? If I read the GDPR, the Debian foundation is not capable to pinpoint 1 person so it seems to me it is not (An ISP or someone receiving an IP to person mapping from them is something different):
‘personal data’ means any information relating to an
identified or identifiable natural person (‘data subject’);
an identifiable natural person is one who can be
identified, directly or indirectly, in particular by
reference to an identifier such as a name, an
identification number, location data, an online identifier
or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or
social identity of that natural person;
processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party,
except where such interests are overridden by the
interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in
particular where the data subject is a child.
However, I can't recall ever having seen this privacy policy before now. IANAL and don't know what kind of notice needs to be given for necessary data usage, if any, but maybe apt-get should display the privacy policy on first use.
> “Processing shall be lawful only if and to the extent that at least one of the following applies: […] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
And
> “The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.”
Are you storing IP's for a certain time, so you can discover and investigate attacks?
> include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.
Are you storing IP's for a certain time, so you can run analytics?
> Further processing for [...] statistical purposes should be considered to be compatible lawful processing operations.
Are you doing direct marketing to your customers?
> The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. [Legitimate interest] There is a relevant and appropriate relationship between the data subject and the controller [...], such as where the data subject is a client or in the service of the controller.
If you are not big enough to have a law department look at this, you don't need to worry so much about a weblog.
Put in a blunt way - Looking at my logs, I am not trying to identify Mr William Butterscotch living at 22nd tower street, third floor, second door on the right. I'm trying to figure out if a set of IPs is actively scanning or ddos'ing my systems. Especially because these IPs might actually not be connected to any human at all - think of botnets just roaming the ipv4 space.