Cookies, Analytics and GDPR

On the 25th of May 2018, GDPR comes into effect in the EU Union. The GDPR directive brings a lot of important requirements to websites since such regulation imposes special requirements on user tracking, cookies and also what defines personal data.

GDPR gives personal data a new form, where the individual has a lot of power on what information is stored, what can be stored about him, what is done with it and the individual has the right to know of any breaches to the integrity of this data. Failure to comply with the GDPR results in hefty fines. This article focuses mainly on website visitors which do not submit specifically any user information but act solely on a user visiting a website. GDPR imposes that website visitors must know that websites use cookies to track their activity with the intent that specialized content is displayed for their view. Web administrators are obliged to put in notices that websites are storing and using cookies to track user activity. Together with this the data cannot be stored forever and to comply with this, web analytics sites such as Google have updated their functionality including default retention policies to get rid of older data.

But what about logs?

Parts of a log file are still considered as private data. These can include the IP address and in some cases the Request string, however, there is no obligation to get user consent from the user when visiting a website that the web server in fact stores logs. I think it’s a standard that most web servers do in fact store logs. However, storing and processing logs is still regulated.

Logs Compliance with GDPR

• Keep logs secure
Ensure that your passwords meet the required security complexity guidelines, as well as the necessary accounts, are enabled to access log files.
• Access logs and transfer them via encrypted protocols – SFTP / FTPS or any other encrypted medium.
This means that all access should be via secure channels and avoid using 3rd party providers to send log files unless you know that they can be trusted and are GDPR compliant themselves.
• Do not keep logs for long periods of time (set up valid retention policies based on your needs).
Part of GDPR compliance is to have proper retention policies in place. and get rid of data when it’s no longer required
• Identify what is being stored in your log files.
Identify what is stored in the logs, typically it is the IP address and the Request headers that could contain personal data, however, this depends on the applications.
• Avoid uploading logs to 3rd party providers, and analyze logs yourself with local tools such as Apache Logs Viewer.
Unless you have a written guarantee that the 3rd party provider is fully GDPR complaint then it’s best to avoid sending logs to anybody else and process them locally using any tool of your own choice. Apache Logs Viewer does not transmit any form of data and is local to the installation.
• Encrypt your disks
Analyses log files on encrypted media with the aid of functionality such as BitLocker in Microsoft Windows, just in case the system is lost or compromised.

Benefits of http Logs Viewer over 3rd party providers

• You do not need to ask for Cookies’ permission when your visitors visit your websites
• You own the data not other 3rd party providers
• If necessary you can easily filter out any data to identify if there is anything pertaining to a particular individual.
• You can easily export data to a portable format.

Disclaimer: Please note that this article is not created by a lawyer and is only offered after various research and consultation with legal entities on the matter. Do not use this as a basis for your legal requirements and when in doubt please consult with your lawyer.