Statement on 4 Years of GDPR

These are all valid and sensible solutions if you are building a greenfield system. But GDPR applies to all systems, even those that were build years before its inception and the developers of whose could not in a million years have imagined that one day some crazy bureaucrats would criminalize logging IPs. Now think about even a moderately sized enterprise, that runs gazillions of individual apps (in-house, vendor-provided and SaaS), and the work required to auditting all the places you need clean when you want to delete all logs containing one IP.

And that's just one small aspect of becoming fully compliant, there are millions of other types of surprising data that can be PII, and hence a liability, under GDPR. Email and IM apps, like Slack, are another interesting conundrum. Under GDPR, a customer should be able to request that all emails and Slack messages that contain/discuss his/her personal information must be a) discoverable and b) erasable. How do you even begin to solve that is beyond me..

Easy peasy unless your system was built before it became illegal to "haphazardly" process PII. Even organization that take GDPR very seriously and invest a lot on compliance do not generally really know all the places where their legacy systems are storing PII. The law is draconian.

> Tell me for example how would you respect the right to be forgotten for web server access logs?

You don't, nor would you be required to, assuming those logs are being collected for a legitimate non-profiling interest, like detecting abuse, and are only kept for as long as reasonably necessary.

Lets take a look at the cases in which right to be forgotten even applies:

> the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

This would be fair enough if you are keeping the data for longer than necessary, but if you are doing so in such a scenario, you are almost certainly in violation in other ways.

>the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

Not consent based processing, so inapplicable.

> the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

22(2) is direct marketing related so inapplicable. 21(1) is interesting. It allows for subjects to object to legitimate interest processing. The controller must cease processing (including storage based "processing") the data upon such objection "unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims".

But it would not be hard to show that log data important for abuse prevention overrides the interests, rights, and freedoms of the subject here. We are talking about data that is almost certainly not particularly revealing or sensitive to the subject, with a relatively weak personal identifier (IP address), that is not publicly visible, that will automatically be deleted once it is too old to be relevant for such purposes. (probably after only one or two months). We are not talking about say a publicly available archived news article that mentions the street on which the subject lives or anything like that.

>the personal data have been unlawfully processed; >the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

Neither of these would be applicable.

>the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Ok, if you are running a social network, or youtube or something, and the data subject is a child, but they are either over the age of 16, and under it, but had parents consent on their behalf, then technically these logs would fall under this bullet point, and would need to be deleted. Art 8(1) only applies to procesing by consent, but if such consent were given these logs would obviously be related to the offer of such services. This scenario is not really what was intended though, and is poor wording in the law. (The law has a lot of poor wording!).

The idea here looks like it was supposed to be that Children's data processed by consent must be deleted if consent revoked, even if you still retain other legal grounds for that processing. Normally those other grounds would let you refuse to delete the data, but because ramifications of providing data under consent may be unclear to children, they get to revoke it more strongly than adults.

Is there any way of maintaining session IDs across requests without JavaScript other than cookies? My understanding is, the whole point of cookies is that they're automatically sent by the user agent, anything else that was stored (such as in LocalStorage) could only be used by JS scripts.

> DPC = the official Irish body who should be responsible for enforcing GDPR… in bed with Facebook instead

Speaking as an Irish person, it's probably more accurate to say that the DPC is woefully under-resourced, and FB are super litigious so its more the government haven't given the DPC enough resources to do their job.