3

I run a pet project server with a private website (which is put down for now due to GDPR) that I use to show of artworks that I did. It does not have a user login or anything, only a small form for users to comment. Although my site doesn't process personal data (not by itself or by third party tools) I put it down by replacing it with a blank page, only leaving my basic auth protected private webmail-backend online. Someone contacted me recently and told me I still need a privacy policy since even with a blank page I process personal data like IP-Address or browser which is logged (for now I just completely shut down and disabled apache until I find the time to fix this). I run fail2ban on my server and in fact use the logs for automatically banning IPs that show malicious behavior. So I guess I'm actually processing personal identifiable information?

Does that mean the server still needs to have a privacy policy, even with a blank page?

And to think a step further: Wouldn't that also mean that the server needs a privacy policy as long as it is a public reachable server, even if it does not offer any services since a simple ping could place an IP in its logs or failed attempts against ssh would ban an IP (which would prove that it has been processed and stored).

To make it clear. I'm not asking how to avoid having a privacy policy. Im just curious if a server that provides no service to users at all (e.g a blank or no website that only serves as a private git-repo server or/and is only accessible via terminal) really still needs a privacy policy.

Improve this question
2
  • Why are you avoiding creating a privacy policy? GDPR does require you to have one if you're tracking things like IP address (which most Analytics programmes do). You can block them from your servers if you wish but my view is that there will be something that you haven't thought about that will trigger the need for a privacy policy and compliance. You would need to be able to prove that you don't collect any form of PII which will probably be more hassle than creating and complying.
    – Jade
    Jun 12, 2018 at 12:29
  • I will add a privacy policy once I find the time. Since it is just a pet project I simply shut it down for now. The question is: can a public machine that delivers no service exist in the EU without a privacy policy since it's almost impossible to have a server that does not at least track IPs somehow because how connections are established. I did not ask how to avoid having one. My server does not track anything (no google-analytic or whatever) beyond the standard logging of incoming connections (HTTP, SSH and the like).
    – Takiro
    Jun 12, 2018 at 13:07

1 Answer 1

Reset to default
1

As long as you do not collect personal data of a human, you do not need a GDPR. Please note, log files with IP addresses are personal data for GDPR.

Improve this answer
1
  • So as soon as the server uses something like fail2ban, which does not work without logs, it needs a privacy policy even if it does not actually has a website or delivers a public service. Law aside, this is kinda ridiculous since any IP I could randomly Ping in the EU would need to set up an otherwise unneeded web server just to deliver a Pricacy Policy x3.
    – Takiro
    Jun 13, 2018 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.