Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

GDPR and Statistical Analytics

Discussion in 'General Discussion' started by nickwuk, Apr 6, 2018.

Tags:
  1. nickwuk

    nickwuk Member

    Joined:
    Jul 18, 2009
    Messages:
    22
    Likes Received:
    2
    Trophy Points:
    53
    IP addresses are considered as Personal Identifiable Information (PII) under GDPR and therefore, although there may be a legitimate reason for recording IP addresses in raw server logs to maintain security, does that mean that IP addresses stored by AWStats, Analog Stats, and Webalizer for analytics need to be anonymised by eg changing the last segment to zeroes? Is IP anonymisation an available option in this software, and if not then does that mean this software needs to be disabled in Cpanel?
     
    #1 nickwuk, Apr 6, 2018
  2. cPanelLauren

    cPanelLauren Forums Analyst
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    372
    Likes Received:
    21
    Trophy Points:
    93
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hello @nickwuk

    We have a blog post that addresses some points of GDPR compliance and how it affects cPanel, some quotes from that article that should be noted are as follows:

    With that being said there is not any built-in feature that allows for removal or modifications of IP addresses in the statistics but I would strongly advise you to open a feature request for this here: cPanel Feature Requests - the site is currently undergoing maintenance and should be up in the near future.

    Thank you,
     
    #2 cPanelLauren, Apr 6, 2018
  3. lorio

    lorio Well-Known Member

    Joined:
    Feb 25, 2004
    Messages:
    270
    Likes Received:
    7
    Trophy Points:
    168
    cPanel Access Level:
    Root Administrator
    You have many logs, which contain the IP. GDPR is not demanding that do not record IP addresses. You need to document everything. That is the hard work. cPanel Update and you got a new logfile somewhere. So you might have an interest in keeping the amount of saved data as low as possible. That way exposure of data is minimized.

    cPanel could start offering some tools or help around removing logfiles and data. And to reduce the amount of data that gets saved. Reducing apache logging accountwise could be done via CustomLogs, which are piped through a script.
    E.g. scripts like this Anonip | Swiss Privacy Foundation

    IPs could be converted into hashes (quite common option in webanalytics to be able to follow people through webpages without storing IPs longer than needed). You can find such options in Wordpress analytics addons.

    GDPR gives people the right, to get an export of all their data saved with you. That is a bit tricky when you got everything cluttered around in many logs and databases. When GDPR is in action and the first court-rulings are done, we might see a consolidation in the reseller space. Or more software designed around handling data in compliance with GDPR.
     
    #3 lorio, Apr 11, 2018
  4. nickwuk

    nickwuk Member

    Joined:
    Jul 18, 2009
    Messages:
    22
    Likes Received:
    2
    Trophy Points:
    53
    It looks like AWStats and the like simply read IP data from the raw access logs ie no dedicated storage log, and I would hope that IP's in raw access logs are exempt from anonymising on the grounds of security (GDPR Recital 49 - I'm waiting for a response from the ICO on this question about exemption), although the requirement to minimise the length of time PII data is stored would have an impact on statistical history (unless using anonymisation as lorio mentions). If IPs in raw access logs were to be exempt then the right of access and portability I assume would not apply, however is there then still a GDPR issue with sharing those IPs with third party statistical analysis software?

    It will be interesting to see the response from well known Wordpress security plugins. There is obviously other software that does store IP addresses for purely for statistical analysis which as I understand will need to anonymise those IPs.
     
    #4 nickwuk, Apr 11, 2018
  5. cPanelLauren

    cPanelLauren Forums Analyst
    Staff Member

    Joined:
    Nov 14, 2017
    Messages:
    372
    Likes Received:
    21
    Trophy Points:
    93
    Location:
    Houston
    cPanel Access Level:
    DataCenter Provider
    Hi @nickwuk

    If you do get a response from the ICO on the question could you post it here? It may be useful for other members in the future.

    I also want to note if the issue is the length of storage time you can control the length of time you keep logs. Speaking specifically of the domlogs (domain access logs or raw access logs) you can modify the amount of time you keep them directly from WHM in Tweak Settings under Stats and Logs there are a few options:

    - Delete each domain’s access logs after statistics are gathered
    This setting will force the system to delete all access logs after each run. The Metrics data will be present but the actual log files will be removed

    - Archive logs in the user's home directory at the end of each stats run unless configured by the user.
    This option will only be used if the user does not configure their log archiving preferences in cPanel and will archive their logs in /home/$user/logs/

    - Remove the previous month's archived logs from the user's home directory at the end of each month unless configured by the user.
    This option will only be used if the user does not configure their log archiving preferences in cPanel.

    cPanel also has some logs it rotates which can be modified as well such as ModSecurity,UPCP etc.

    You can also modify logrotate to modify any log files at specific intervals of your choosing
     
    #5 cPanelLauren, Apr 11, 2018
  6. lorio

    lorio Well-Known Member

    Joined:
    Feb 25, 2004
    Messages:
    270
    Likes Received:
    7
    Trophy Points:
    168
    cPanel Access Level:
    Root Administrator
    If you think about certain countries with data retention laws, you might are not allowed to delete data for a certain time-span. Every country can overrule parts of GDPR (mostly tax related)

    You're correct, that the Stattools offered via cPanel are accessing the logfiles. There is no other source. That makes is easier than using e.g. Google Analytics but IPs are stored. In e.g. Germany there are websites, which log 127.0.0.1 for every webaccess.
    This is stated in the data-protection information on these website. Some use thirdparty tools to tweak the storage behavior
    webfactory/mod_log_ipmask

    Many wordpress plugins with analytics or security functionality are offering tools to delete or change IP addresses in logfiles since years. Nothing new beside you now have a generic label "GDPR" to make it more easy to find such functions.
    Eg. Deleting and shorting IP:
    NinjaFirewall and the General Data Protection Regulation (GDPR)
    E.g Hashing IP:
    Settings Page - WP-Statistics

    The core of wordpress seems to get GDPR functionality as well.
    Proposed roadmap: Tools for GDPR compliance

    GDPR is not forbidding saving all this stuff. There are reasons to save IPs for longer times.

    I would like to see a way, to setup data retention time span and format of logging for every website via cPanel. Just a small step, when you think about all the logs and datastreams. The website seems to be a bigger part with all the external scripts (e.g. Google Analytics is known, but you have the same IP issue with Google Fonts and Google Maps.).
     
    #6 lorio, Apr 11, 2018
    Infopro likes this.
(You must log in or sign up to post here.)
Loading...
Similar Threads - GDPR Statistical Analytics
  1. fullfatdesigns

    GDPR for dedicated Server

    fullfatdesigns, Mar 25, 2018, in forum: Security
    Replies:
    7
    Views:
    237
    DennisMidjord
    Apr 11, 2018

Share This Page