Side note, but ips being pii is pretty tricky. Think about all the places an IP is logged in the clear.

I think they are probably on the right path here but I've never worked somewhere that wouldn't be breaking the rules here.