Forum Moderators: webwork
It is any EU citizen anywhere in the world
Territorial scope
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
Source: [eur-lex.europa.eu...]
[edited by: Shaddows at 1:12 pm (utc) on May 4, 2018]
Part of this issue is the IP addresses and other data found in server access logs.
The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
So, Citizenship is irrelevant. It is the Data Subject's physical location. Americans are covered while on EU soil, while Germans are not while in the USA.
Recital 49
The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.
It does apply. I've had discussions with several hosting companies where the sites I manage reside. Log data is being regulated by the upcoming GDPR.Part of this issue is the IP addresses and other data found in server access logs.Possibly, but you are probably safe if you do not collect any other data (like email addresses) on the site in question. The reason being, it is not reasonable for you, a private site owner, to tie server log data to a particular person- unless you then collect other data...
Generally, as outlined by the GDPR, websites outside the EU but who have EU visitors have 3 options.
No offence, but says who?@Shaddows - this comes from admins at the several US hosting companies I deal with for clients. Please read the link.
Why would US companies need additional services beyond what we in the EU have to do?I don't see US companies doing anything more than EU companies. Again, read the link posted in the OP.
Some companies that provide services to us run their services from outside the European Economic Area. We only let that happen if we are satisfied with their levels of security. Keep in mind that when you give us personal information it could be being transferred, stored or processed in a location outside the EEA.
Our data center [ragingwire.com] complies with the EU-US Privacy Shield Framework [privacyshield.gov] as set forth by the US Department of Commerce regarding the collection, use and retention of personal information from European Union member countries.
Logs with users' identifiers removed (but including IP addresses and user agent strings) may be securely retained for a period of 96 hours or less. This period of time balances privacy concerns with the need to ensure that log processing systems have time to operate; that operations engineers have time to monitor and fix technical and performance problems; and that security and data aggregation systems have time to operate. These logs will not be used for any other purpose.
Logs with users' identifiers removed (but including IP addresses and user agent strings) are encrypted and securely retained for a period of 72 hours or less...I feel now we are in full compliance with GDPR regulation.
