This is not really a post about GDPR but one about thinking of solutions to problems. As detailed in my last post, I can grab an IP address and was wondering what I could do with it.
{
"ip": "123.45.6.78"
}I figured I could automatically gather some location data from the IP address and do some cool looking visualisations from that. There are quite a few APIs out there that let you do this for free, ip-api for example. So my idea was that I use that, grab the latitudes of visitors to the site and do something with the numbers. I have no plans to store any timestamps or any other identifiable information which I hope should keep me on the right side of the GDPR regulations.
However, I wasn’t sure if ip-api stored anything when you made a request to their API so this led me to think about writing something that would get the location data without relying on any third party to do so. To do this you typically have to look up the IP address in a database that stores location data against a range of IP addresses.
MaxMind provides a set of these for non-commercial use under a Creative Commons licence and there is also a nice npm package that you can use with it.
So instead of using third-party software I am hosting the database myself, not storing any identifiable data and hopefully sitting on the right side of the law. And also getting some interesting data for use elsewhere.
{"data":{"city":{"geoname_id":3448439,"names":{"de":"São Paulo","en":"São Paulo",
"es":"São Paulo","fr":"São Paulo","ja":"サンパウロ","pt-BR":"São Paulo",
"ru":"Сан-Паулу","zh-CN":"圣保罗"}},"continent":{"code":"SA","geoname_id":6255150,
"names":{"de":"Südamerika","en":"South America","es":"Sudamérica","fr":"Amérique du Sud",
"ja":"南アメリカ","pt-BR":"América do Sul","ru":"Южная Америка","zh-CN":"南美洲"}},"country":
{"geoname_id":3469034,"iso_code":"BR","names":{"de":"Brasilien","en":"Brazil","es":"Brasil",
"fr":"Brésil","ja":"ブラジル連邦共和国","pt-BR":"Brasil","ru":"Бразилия","zh-CN":"巴西"}},
"location":{"accuracy_radius":20,"latitude":-23.5475,"longitude":-46.6361,"time_zone":
"America/Sao_Paulo"},"postal":{"code":"01323"},"registered_country":{"geoname_id":6252001,
"iso_code":"US","names":{"de":"USA","en":"United States","es":"Estados Unidos","fr":"États-Unis",
"ja":"アメリカ","pt-BR":"EUA","ru":"США","zh-CN":"美国"}},"subdivisions":[{"geoname_id":3448433,
"iso_code":"SP","names":{"de":"São Paulo","en":"São Paulo","es":"São Paulo","fr":"São Paulo",
"ja":"サンパウロ州","pt-BR":"São Paulo","ru":"Сан-Паулу"}}]}}One thing I did discover while looking into this is that IP addresses can still be considered personal data, even if they are only used temporarily in memory. By not storing them and removing them after use, I am keeping the amount of data I process to a minimum, which aligns with GDPR’s data minimisation principle.
I guess it is a strange topic to consider when working on a small project like this, especially as the site visitors at the moment are limited to me and the odd webcrawler. But exploring it has led me to some more interesting data than I was expecting and the tools to use if a scaled-up version is ever needed in the future.