5 ms·

Wow. This is great! US Privacy Laws would benefit to be at least this strong

by sova 9y ago

spookthesunset 9y ago
Its good as a person, but it is a pain in the ass for companies. Things like the domain name used in an email address can be considered PII because if the domain name was your name, that is PII... IP addresses can, in many cases, also be considered PII. Once something is PII, you as a company have to treat that data different--you have to be able to provide that data to the person and you have to be able to delete it. Basically, the overall idea is good (data about you should be owned by you) but mapping that into actual nuts & bolts implementation details is a huge pain in the ass.
- zAy0LfpBZLC8mAC 9y ago
  > Things like the domain name used in an email address can be considered PII because if the domain name was your name, that is PII... That's ... just wrong. The email address itself, unless it happens to be a role address, is PII. Whether there is a person's name in there doesn't matter. > IP addresses can, in many cases, also be considered PII. Really, no, the address isn't PII, the information about someone's behaviour is. You may store IP addresses as much as you like. You just may not store it as a key that could be used to link information about someone to other information about them. > Basically, the overall idea is good (data about you should be owned by you) but mapping that into actual nuts & bolts implementation details is a huge pain in the ass. I wouldn't say it's always trivial, but it's not really that hard either. The only thing that is really hard is collecting data that you have no justification to collect. If you simply avoid collecting data, none of the other stuff affects you.
  - Silhouette 9y ago
    The only thing that is really hard is collecting data that you have no justification to collect. If you simply avoid collecting data, none of the other stuff affects you. Unfortunately, since our modern digital world works with data, that particular tautology is next to useless. With my small business hat on, I'm deeply concerned about the real world implications of the GDPR next year, even as with my privacy advocate hat on I'm happy that the kinds of big data-hoarding companies that cause most of the real problems are going to face more meaningful regulation.
  - spiznnx 9y ago
    PII just stands for personally identifying information. If it identifies you, it is PII. Even if it isn't linked to any behavioral data explicitly, the fact that its in your DB means they are associated with you. Thus email and IP are PII.
    - zAy0LfpBZLC8mAC 9y ago
      No, if it is in your DB because it gets written to that DB as a result of them being associated with you, then that is PII, prescisely because that is information about them being associeted with you. If you use an RNG to generate IP addresses, that does not represent any information about any person, hence no PII, even if it is in fact the IP address of a person that is protected under the relevant regulation.
      - zjs 9y ago
        More specifically: "If a business collects and processes IP addresses, but has no legal means of linking those IP addresses to the identities of the relevant users, then those IP addresses are unlikely to be personal data. However, businesses should note that if they have sufficient information to link an IP address to a particular individual (e.g., through login details, cookies, or any other information or technology) then that IP address is personal data, and is subject to the full protections of EU data protection law." https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
  - spookthesunset 9y ago
    > That's ... just wrong The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. Therefore, if you collect email addresses you have to go through great pains to protect them. As for the rest of your stuff, while you are technically correct your comment is pretty useless. We live in a data driven world that requires.... well... collecting data. Saying "just dont collect email" isn't helpful and collecting IP address info without associating it with use data is pretty pointless. It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. > If you simply avoid collecting data, none of the other stuff affects you. If you are doing anything useful on the internet, you are collecting data.
    - zAy0LfpBZLC8mAC 9y ago
      > The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. You are simply missing the point. It's not required to "contain" anything. If it is the email address of a person, then that makes it PII. > Therefore, if you collect email addresses you have to go through great pains to protect them. Well, yes, of course you do? If you want to profit from using other people's addresses, you better make sure they don't get harmed by it. > We live in a data driven world that requires.... well... collecting data. Erm ... no? We don't live in a data driven world, we live in a world where some people are completely unwilling to respect the boundaries of other people and consider it their right to do whatever it takes to manipulate them in their interest. There is no such right, there is nothing that requires that you violate other people. > Saying "just dont collect email" isn't helpful Well, whether it is helpful depends on what you expect to be helped with. But it is a perfectly viable thing to do. If people voluntarily hand you their email address so you can send them invoices, say, there is absolutely no problem with you doing so, because that obviously means that there is consent. Anything beyond that, and you are just selfishly trying to ignore the interests of other people, and it is perfectly viable to just not do that. > collecting IP address info without associating it with use data is pretty pointless. ... so don't do it, then? > It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. Erm, well, it's an expensive undertaking to stop being an asshole ... so what? > If you are doing anything useful on the internet, you are collecting data. So, if I publish a free software project on my own web server that doesn't write any log files ... that's not useful? Could you explain how exactly that reasoning goes?
- hossbeast 9y ago
  "implementation details is a huge pain in the ass" Privacy is worth protecting. Plus, it's still a huge value add to your customers if you provide them these controls, whether you're legally required to or not.

Wow. This is great! US Privacy Laws would benefit to be at least this strong

by sova 9y ago

Wow. This is great! US Privacy Laws would benefit to be at least this strong

Its good as a person, but it is a pain in the ass for companies. Things like the domain name used in an email address can be considered PII because if the domain name was your name, that is PII... IP addresses can, in many cases, also be considered PII. Once something is PII, you as a company have to treat that data different--you have to be able to provide that data to the person and you have to be able to delete it. Basically, the overall idea is good (data about you should be owned by you) but mapping that into actual nuts & bolts implementation details is a huge pain in the ass.

zAy0LfpBZLC8mAC 9y ago
> Things like the domain name used in an email address can be considered PII because if the domain name was your name, that is PII... That's ... just wrong. The email address itself, unless it happens to be a role address, is PII. Whether there is a person's name in there doesn't matter. > IP addresses can, in many cases, also be considered PII. Really, no, the address isn't PII, the information about someone's behaviour is. You may store IP addresses as much as you like. You just may not store it as a key that could be used to link information about someone to other information about them. > Basically, the overall idea is good (data about you should be owned by you) but mapping that into actual nuts & bolts implementation details is a huge pain in the ass. I wouldn't say it's always trivial, but it's not really that hard either. The only thing that is really hard is collecting data that you have no justification to collect. If you simply avoid collecting data, none of the other stuff affects you.
- Silhouette 9y ago
  The only thing that is really hard is collecting data that you have no justification to collect. If you simply avoid collecting data, none of the other stuff affects you. Unfortunately, since our modern digital world works with data, that particular tautology is next to useless. With my small business hat on, I'm deeply concerned about the real world implications of the GDPR next year, even as with my privacy advocate hat on I'm happy that the kinds of big data-hoarding companies that cause most of the real problems are going to face more meaningful regulation.
- spiznnx 9y ago
  PII just stands for personally identifying information. If it identifies you, it is PII. Even if it isn't linked to any behavioral data explicitly, the fact that its in your DB means they are associated with you. Thus email and IP are PII.
  - zAy0LfpBZLC8mAC 9y ago
    No, if it is in your DB because it gets written to that DB as a result of them being associated with you, then that is PII, prescisely because that is information about them being associeted with you. If you use an RNG to generate IP addresses, that does not represent any information about any person, hence no PII, even if it is in fact the IP address of a person that is protected under the relevant regulation.
    - zjs 9y ago
      More specifically: "If a business collects and processes IP addresses, but has no legal means of linking those IP addresses to the identities of the relevant users, then those IP addresses are unlikely to be personal data. However, businesses should note that if they have sufficient information to link an IP address to a particular individual (e.g., through login details, cookies, or any other information or technology) then that IP address is personal data, and is subject to the full protections of EU data protection law." https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...
- spookthesunset 9y ago
  > That's ... just wrong The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. Therefore, if you collect email addresses you have to go through great pains to protect them. As for the rest of your stuff, while you are technically correct your comment is pretty useless. We live in a data driven world that requires.... well... collecting data. Saying "just dont collect email" isn't helpful and collecting IP address info without associating it with use data is pretty pointless. It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. > If you simply avoid collecting data, none of the other stuff affects you. If you are doing anything useful on the internet, you are collecting data.
  - zAy0LfpBZLC8mAC 9y ago
    > The lawyers would disagree with you. If the email address contains anything that identifies you personally, it's PII and thus falls under GDPR. You are simply missing the point. It's not required to "contain" anything. If it is the email address of a person, then that makes it PII. > Therefore, if you collect email addresses you have to go through great pains to protect them. Well, yes, of course you do? If you want to profit from using other people's addresses, you better make sure they don't get harmed by it. > We live in a data driven world that requires.... well... collecting data. Erm ... no? We don't live in a data driven world, we live in a world where some people are completely unwilling to respect the boundaries of other people and consider it their right to do whatever it takes to manipulate them in their interest. There is no such right, there is nothing that requires that you violate other people. > Saying "just dont collect email" isn't helpful Well, whether it is helpful depends on what you expect to be helped with. But it is a perfectly viable thing to do. If people voluntarily hand you their email address so you can send them invoices, say, there is absolutely no problem with you doing so, because that obviously means that there is consent. Anything beyond that, and you are just selfishly trying to ignore the interests of other people, and it is perfectly viable to just not do that. > collecting IP address info without associating it with use data is pretty pointless. ... so don't do it, then? > It is a huge, expensive undertaking to make any kind of "legacy" pre-GDPR infrastructure GDPR compliant. Erm, well, it's an expensive undertaking to stop being an asshole ... so what? > If you are doing anything useful on the internet, you are collecting data. So, if I publish a free software project on my own web server that doesn't write any log files ... that's not useful? Could you explain how exactly that reasoning goes?
hossbeast 9y ago
"implementation details is a huge pain in the ass" Privacy is worth protecting. Plus, it's still a huge value add to your customers if you provide them these controls, whether you're legally required to or not.