How a visitor counter got GDPR approval: *the minimisation question*

What IMY decided

On 4 October 2024, IMY approved Bumbee Labs' visitor counting solution under GDPR Article 6(1)(f), legitimate interest ^[1]. The decision is worth reading because it shows what data minimisation and integrity look like in practice.

The system counts unique visitors to a website. It takes a fingerprint of each visitor's IP address combined with their user agent string, stores the fingerprint for 24 hours to avoid counting the same visitor twice, and then deletes it. No IP address, no user agent and no other personal data is stored after that.

IMY approved the solution because the processing is minimal, temporary and transparent, and because the legitimate interest in understanding web traffic outweighs the privacy impact.

The minimisation question

Article 5(1)(c) of the GDPR requires personal data to be adequate, relevant and limited to what is necessary ^[2]. A visitor counter could store full IP addresses, device identifiers and browsing histories. This one doesn't.

Think of it like a nightclub counting heads. The bouncer clicks a counter as people walk in. Nobody writes down names, and the counter resets at closing time. The club gets the number it needs, and nobody keeps a list.

Bumbee Labs' solution works the same way. The fingerprint exists just long enough to avoid double-counting, and then it's gone. That's minimisation.

Integrity and demonstrability

Article 5(1)(f) requires appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage ^[2]. Article 32 goes further: security measures must ensure the ongoing confidentiality, integrity and availability of processing systems.

Integrity means the data hasn't been altered. In this case, it also means the organisation can show that the fingerprint was deleted after 24 hours, as promised.

Article 5(2) makes demonstrability explicit: the controller is responsible for compliance and must be able to demonstrate it ^[2]. It isn't enough to say you delete data. You have to be able to show it.

Why it matters for anyone counting visitors

If you run a website and count visitors, this decision gives you a model to follow. Collect a fingerprint, not the full data. Delete it quickly. Document why you need it and how you protect it.

The harder question is how you prove to IMY, or to a visitor who complains, that you actually did what you said. Logs help, but logs kept by the same people who could change them are easier to challenge.

How a digital witness helps

Here, the thing to seal is a record of what data the system held and when it was deleted. You could seal a daily summary: how many fingerprints were created, how many were deleted and the retention check that confirmed none were older than 24 hours.

Sealing takes a fingerprint of the record, not the record itself, so the processing log never leaves your systems. If IMY or a data subject later asks whether fingerprints were deleted on schedule, anyone you share the record with can check that it's the one written on the day, unchanged since.

The witness doesn't show that the deletion was done correctly, or that the retention logic had no bugs. It shows that the record of what happened hasn't been quietly rewritten.

You seal the record when the retention check runs, every 24 hours. Your own systems, auditors, IMY and the data subject can all check the sealed record independently. WitniumChain takes the fingerprint and returns a witness ID. To check, you calculate the fingerprint again and compare it with the sealed one. The content stays with you. The first 2,000 witnesses a month are free, and you can read the documentation before you start.

How it would work

1. Run your retention check every 24 hours and log what was deleted.
2. Seal the log entry with one API call.
3. If questioned, share the sealed record so anyone can verify it hasn't changed.

What this means for you

If you process personal data on websites, in apps or through AI systems, ask yourself:

• Do we collect only what is necessary, or are we keeping data just in case?
• Can we demonstrate that data is deleted when we say it is?
• If IMY or a data subject asked for proof, what records could we show, and how would we prove they haven't been altered?

The answers matter before the questions arrive.

What to watch

The GDPR has applied since 25 May 2018. Demonstrability has been part of it from the start, but enforcement is tightening. Retention policies, access logs and deletion records are being scrutinised more closely in audits and in complaints.

For high-risk AI systems under the AI Act, logging duties start on 2 August 2027 for existing systems in Annex I and on 2 December 2027 for new systems in Annex III. Those logs will need to meet the same integrity and demonstrability standards.