3 ms·

I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning o

I skimmed that link and couldn't figure out what they mean by "processing". (It's related to compliance with a law, so I assume that the common sense meaning of a word isn't necessarily what is meant.) Do you understand what they mean by "processing" in this context? It seems like you're saying that analyzing IP addresses a user connected from in order to determine their likely employer is against the UK's GDPR guidance, even if the data is released only in aggregate (but that it might be fine to keep that IP data since perhaps there are other uses for it which would be legitimate). Is that your understanding?

teget 9y ago
Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law: > (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (Directive 95/46/EC) All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss). [1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lang1=de&type=TXT&ancre= http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...
mattmanser 9y ago
It's not about what you release to the public, if you're processing this data in private it's still culpable. This page gives it some context: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Further down are the 6 reasons for processing. We know the first 5 don't apply: consent - there's no consent contract - it's not necessary to provide the Q&A answer site Legal obligation - there's no legal obligation Vital interests - nope Public task - nope So what it falls under is "Legitimate interests", SO want to use a user's IP address, process it to add company name, store that and then use that data for profiling their customers to serve them ads. One of the problems for SO is that further down they go into this a bit more and there's a few key questions: Would individuals expect this processing to take place? Are some of the individuals concerned likely to object? Are you able to stop the processing at any time on request? Which I would think would be answer No, Yes, No. Which seems to indicate that there's some problems with SO's approach.

teget 9y ago

Since these provisions are most likely based on EU directives I would assume that this definition is also reflected in UK law: > (b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; (Directive 95/46/EC) All IPs are personal data (even if they are dynamicly assigned) if I read [1] correctly (Not a lawyer and there is most likely something I miss). [1] http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lang1=de&type=TXT&ancre= http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&lan...

mattmanser 9y ago

It's not about what you release to the public, if you're processing this data in private it's still culpable. This page gives it some context: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Further down are the 6 reasons for processing. We know the first 5 don't apply: consent - there's no consent contract - it's not necessary to provide the Q&A answer site Legal obligation - there's no legal obligation Vital interests - nope Public task - nope So what it falls under is "Legitimate interests", SO want to use a user's IP address, process it to add company name, store that and then use that data for profiling their customers to serve them ads. One of the problems for SO is that further down they go into this a bit more and there's a few key questions: Would individuals expect this processing to take place? Are some of the individuals concerned likely to object? Are you able to stop the processing at any time on request? Which I would think would be answer No, Yes, No. Which seems to indicate that there's some problems with SO's approach.