Re:Debian Privacy Issues
by cmeacham98 on Monday February 13, 2023 @12:24PM
(#34776737)
Again, as I have said multiple times in this thread existing EU case law has made it clear IPs are only PII if and ONLY if you are able to do the conversion yourself (or give it to someone who can). Storing IPs in your web server logs is for an anonymous version checker is totally ok (as long as you aren't an ISP or someone who can do the conversion).
You can make up your own interpretations of the law as much as you want, but in real life the interpretation from the CJEU (for US readers like me, the EU's equivalent of the Supreme Court) is the one that matters.
An IP address alone may not reveal who had visited a site. However, Internet Service Providers have additional data that can link IP addresses to individual people. Although it's unlikely that the two data sets will ever be matched up, it is possible. So IP addresses must be treated as personal data.