"Quote from: almodovaris on February 08, 2023, 06:33:34 PMI think that is not correct. The procedure is basically subject to the GDPR regardless of any subsequent "processing" on the server. Already the "collection" from the firewall (always with IP address, but according to text at Heartbeat also with "unique node identifier").
The only problem is if you tie such data to a person. If it is anonymised, it is not a privacy matter.
In addition, one must also see the legal regime separate from the GDPR, Article 5 Section 3 EU Directive 2002/58 (as amended in 2009), which regarding the "storage" and "readout" of information (regardless of the personal reference!) sees strict interpretations regarding "absolute necessity" and "expressly desired by the user".
Back to the personal reference of the GDPR:
There have been several ECJ rulings on personal reference (e.g. via IP address; like C-582/14), i.e. when there is basically the possibility of identification.
Arguments:
- Here one must see the IP address of the firewall.
- Also, a static/long-lived identifier (as in Heartbeat: "unique node identifier") is explicitly listed in Art. 4 paragraph as "identification number".
- In addition, a fingerprint could already be created via the interaction of the information transmitted during the "Heartbeat" event, which would make recognition possible.
In my view, there is no legal basis for "Heartbeat".
- There is no "necessity" for a contractual basis (6.1.b GDPR) (the Zenarmor firewall functions also work without notification that an instance is online; of course, cloud management does not work, but that is already optional). The supervisory authorities have a strict understanding of the "core" of the contract.
- Likewise, consent (6.1.a GDPR) lacks "voluntariness" (7.4 GDPR).
- "Legitimate interest" would be conceivable (6.1.f GDPR), but then it is irritating why a non-selectable checkbox (sounds like "opt-out") is offered. Also, I wonder what the "usual expectations" of the user are.
For legitimate interests - cf. https://www.sunnyvalley.io/docs/opnsense/configuring/configuring-zenarmor-privacy-settings-on-opnsense-firewall#heartbeat-and-license-check :- There is reference to "license verification". But with the free license, this is not necessary.
- Regarding "checks the state of packet processing worker" this is possibly a legitimate interest (low hurdles here), but in a weighing with the interests of the user I consider it very low and against it the interests of the user predominant.
(Example: what does it help the user if the manufacturer finds out that his installation with free firewall license does not work anymore? There is no automatic help from the manufacturer).
It might be the case - this is pure speculation - that the manufacturer wants to know about the number of running installations, but this potential "legitimate interests" of him is not listed (to my understanding) in the description of "Heartbeat". It would be preferable for the user if the manufacturer would allow a non-compulsory opt-out for the user (beside Art. 21 GDPR "on grounds relating to his or her particular situation"). Also I think the interests of the user are also predominant here.
