GDPR, filtering, unauthenticated domains

[free780]

So in terms of the right to be forgotten requirement of GDPR how does this work with filtering?

 

Some services Office 365 etc may be allowed unauthenticated. This is true when using NTLM or Kerberos.

 

If a staff member or student wishes to be forgotten how can you forget logs of visiting unauthenticated domains?

 

Does there need to be a shift to use Radius /802.1x for authentication and use an intercepting proxy?

[Steve21]

Not sure what you mean really, if they're unauthenticated websites by definition it isn't logged as who's visiting it. As normally it'll just show as an IP in filter logs etc

 

Steve

[GrumbleDook]

Try not to overthink it. They can make the request but if you have a legal basis for processing still then you have grounds to retain the logs.

 

If your retention schedule is clear when logs are deleted (e.g. after 6 months) then this could be considered reasonable.

 

The authenticated bit, in this case, doesn’t become important at that point as all data (remembering IP address is considered personal data) will not be kept for long.

 

If only retaining IP then you need to think about what would be needed to make that Personal Identifiable Information... normally you would have to cross-reference with the DHCP server (MAC address) to identify the device that had the lease (unless you retain that on the filter, of course) ... and so you need to think about how long those logs are kept. If only 4 weeks ... then the IP address is effectively useless after that point ... and you might not consider it personal data, but pseudononymised data instead.