zlacker

No, people were correctly answering the specific question: is an IP address on its own personal data? (No, it can't be used to identify a natural person).

THe problem is that it's a stupid question. No-one has just IP addresses, they have a mix of data. If you can combine the IP address with anything else to identify a natural person it becomes personal data.

>>DanBC+(OP)
And you’re wrong

Ip are personal data https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Without conditions. Even hashing them doesn’t make them ‘irreversibly anonimized’ because the ip space is too small for hashing to be irreversible. A rainbow table can be built with all ips and use to deanonimize the ip.

>>LoSboc+03
The document you link to has this interesting statement:

> The law protects personal data regardless of the technology used for processing that data – it’s technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example alphabetical order). It also doesn’t matter how the data is stored – in an IT system, through video surveillance, or on paper; in all cases, personal data is subject to the protection requirements set out in the GDPR.

That raises an amusing question. Suppose you have a one person business with a small number of customers (a few dozen or so) that you deal with in person. With proper mnemonic techniques it would be possible to do all the storage and processing of their personal data in your head.

Does GDPR apply?

The only thing I see in the quoted paragraph that might suggest it does not is "provided the data is organised in accordance with pre-defined criteria (for example alphabetical order)". Do brains use pre-defined criteria to organize data?

This too raises an interesting question:

> Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.

If data is used to train a neural net and then discarded, but you keep the trained neural net, in some sense the data is still there in the weights of the connections in the neural net. Has it been sufficiently rendered anonymous to no longer be considered personal data?

>>DanBC+(OP)
Haha, the response to your comment here is a perfect example of how ambiguous this law is: you yourself are disagreeing with official interpretations of this law. And the blog post that we’re commenting on here says that personal projects have to comply, while you have posted multiple times saying they don’t?

It’d be really nice for the “fucking idiots” that you referred to earlier if those of you who clearly know what the law says and what it means could get your stories straight.

>>LoSboc+03
No you are wrong. I don’t care what some silly EU court said. IPs are not personal data. They can apply to a range of people.

>>apple4+hm1
I agree ip can address multiple persons. What is common sense matters little. Ip were enshrined in law as personal information and that’s that. It’s stupid, but it’s not something you can just argue away with reason and logic, you have to argue it with lawyers in courts, and given precedents you gonna lose, and that’s what matters.

>>tzs+47
I believe the answer is embedded in the quote that you provided. Can you use the net to go back from weights to data? If not, then it's irreversible.

On the other hand, as parent noticed, hashing IPs is not effective as it's possible to reverse it (the IP space is small).

>>LoSboc+zR1
Could you link to these precedents? I'd like to read that in detail.

>>Boulth+Nu2
> On the other hand, as parent noticed, hashing IPs is not effective as it's possible to reverse it (the IP space is small).

What if you are using IPv6?

>>tzs+Lz2
I assume you mean you use only IPv6? Unfortunately I'm away from the real computer but I guess you could run a simulation like that (try to build rainbow table and see how fast it goes).