Comment by amurgul | Hacker News Reader

Comment by amurgul | Hacker News Reader

You CANNOT, by any means, consider an IP address to be "personal data". You cannot say "I don't want my IP to lay around in a database somewhere" because ... IT IS NOT YOUR IP. An IP address is used to uniquely identify a device on a network, not a person. This device can be (and usually is) a router, a proxy, a server of some kind, a corporate computer, a public computer and so on. Not to mention the fact that a device can also have multiple IP addresses at the same time. So, an IP address CANNOT be used to uniquely identify a person and it really shouldn't be considered in the context of GDPR. Ah, an IP address + some other identification data, that's another discussion. Depending on the combination, it might be considered personal data.

What GDPR says about this is:

> [A]n identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

I think the principle is that since an IP address could be used to identify you, it is considered personal data.

Even under current rules the common household IP-Address appears to be (in combination with any other relevant data (a timestamp for example)) personal data.

> Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person. [ECLI:EU:C:2016:779]

Reply on news.ycombinator.com