&quot;Right of access by the data subject&quot; if the IP address is the only personal data
<p><a href="https://en.wikipedia.org/wiki/IP_address" rel="noreferrer">IP addresses</a> are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article 15 GDPR).</p>

<p>If the IP address is the only personal data in the log, a controller has no way to verify that a requesting person is actually the data subject. Even the requesting person’s <a href="https://en.wikipedia.org/wiki/Internet_service_provider" rel="noreferrer">ISP</a> could only verify that the person is the subscriber (i.e., that the subscriber’s Internet connection had this specific IP address at a specific time), but it’s possible that someone else used the subscriber’s Internet connection at that time (e.g., a family member).</p>

<p>Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?</p>

<blockquote>
  <p>Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?</p>
</blockquote>

<p>The controller has the right to require proof that the personal data is personally data relating to the Internet subscription belonging to natural person making the request.</p>

<p>The burden of proof is borne by the requester.</p>

<p>However, I can <em>imagine</em> a requester first going to his ISP, requesting a complete timestamped log of all the IP-addresses he has been given at various time, getting it notarized, and then providing the controller with this log to get the matching log entries in the controllers web server logs.</p>

<p>However, I can not see what possible use the data subject would have of making such an access request.</p>

<p>(PS: This should not be a access request hard for the controller to comply with. A one line shell-script using a regexp should do it.)</p>

<blockquote>
  <p>IP addresses are "personal data" according to the GDPR.</p>
</blockquote>

<p><strong>Wrong.</strong></p>

<p>IP addresses <a href="https://gdpr-info.eu/recitals/no-30/" rel="nofollow noreferrer">may or may not be</a> personal data, and that directly depends on whether the persons who left those addresses in the log can be identified by the controller/processor at <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">reasonable time/costs</a> (that is, without hiring detectives, data scientists etc.).</p>

<p>If, as you say, <em>"the IP address is the only personal data in the log"</em> then it is not personal data, and therefore the controller does not have to provide anything.</p>

internet gdpr