jngr
commented
7 years ago This matter has been addressed in #295 Exclude IP and some assumptions were made in the discussion, namely that the fact IP addresses are part of any internet communication justifies logging them. That is not the case - at least not everywhere.
For instance, in Germany there have been various court rulings that IP addresses constitute personally identifiable data, and also public awareness regards them as such (meaning people are not likely to give their permission). On web server logs, IPs need to be removed or anonymized, as they may only be kept as long as they are needed. It boils down to the following:
The collection of personal data is
- strictly forbidden by law.
- under some circumstances, data may be stored with permission of the user as long as it's needed for a transaction or a service provided to the customer.
Recording IP addresses as part of supposedly anonymous crash logging
- is not functionality of the app or service provided to the customer
- is usually not needed for bug fixing and
- probably stores records for reference beyond the point the bug is fixed
and will put the developer on very thin ice legally for either of those reasons.
European privacy legislation is undergoing some revisions at the moment, but it looks like the concepts will be very similar. And even current European law states
(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
and
- Member States shall provide that personal data must be:
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.<
Of course there have been some contradictory rulings, for example taking into account the means the operator possessing the IP addresses personally has for tracing them back to the user. But I rather avoid this kind of legal uncertainty and not record this information in the first place. And so should many others, at least those operating in the EU.
Using Acralyzer without the option of excluding the user IP from the logs is likely be illegal or extremely inconvenient, having to extract information from the database and delete the log records frequently.
PaulWoitaschek
Is there a way to optionally remove the user IP from the logging (or replace it with a dummy address)? User IPs are personally identifiable data. As such, recording them is imposing legal risks on the developer, and it's a deterrent for getting user permission to send reports. The IP address is rarely needed for solving an issue.