[davorak]

> IPs combined with other user data could be PII.

1) Bob signs up for a service and is logged

2) Bob than asks for his account to be deleted. Account details are deleted, but the ip logs are retained.

3) Bob signs back up for a new account allowing the data processor to make the link from his new account to his ip old logs with the first account.

This seems like a likely violation, if so you would have to treat ip address like personal information.

[boomlinde]

The personal information here is the IP-Bob tuple, not the IP on its own. Bob might as well be assigned a new address from DHCP on a daily basis. His friends might be using his address. He might have used the address of some public network in the first place. All or these are pretty likely scenarios. The IP is only interesting given the context of who uses it and when, so as to separate Bob from Alice, and Bob's favorite cafe and Bob's workplace from Bob's home, and to figure out if Bob is ever visiting Alice.

So if Bob asks for his personal information to be cleared and the system leaves Bob-IP tuples behind, it clearly didn't do what he told it to do.

[davorak]

That is playing dice while dealing with potentially personal information though right?

It depends on Bob using DHCP, that his DHCP switches often enough, and there are enough people on the same network that the link can not be made.

The above is not always true, other mitigating factors are not always true. Which seems to make some of IP logs personal information. Or at least you are safest if you treat it that way.

I am basing some of my reasoning off an article that I was pointed to earlier: https://www.whitecase.com/publications/alert/court-confirms-...

Where, to my understanding, IP address are considered personal information only if you can link it to some other identifying info.

I think a regulator is unlikely to go after a company for not deleting IP logs in the current climate. As far as I can tell GDPR gives them the power to however.

Until there is some case/enforcement history it is understandable if people are cautious.