4 ms·

They don't collect any personal data. The GDPR defines "personal data" with "‘personal data’ means any information relating to an identified or identifiable na

They don't collect any personal data. The GDPR defines "personal data" with "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary.

Santosh83 9y ago
What about crash reports that will be send automatically to Canonical? I hope they would take precautions to scrub personal information from the data before sending them.
Aaargh20318 9y ago
> Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary. The data collected could be used to identify a single person. How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? If the data is unique enough, it's PII.
- setra 9y ago
  A unique random cookie is not PII automatically. It is only PII if it can be associated with something like a name (not limited to a name). Anonymous data with unique identities is not under the consent requirements of the GDPR.
- y0ghur7_xxx 9y ago
  > The data collected could be used to identify a single person. > How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? > If the data is unique enough, it's PII. You can not connect a unique combination of cpu, gpu, disk size, with me, y0ghur7_xxx, if you don't collect my ip address or my name in any other way, so no, it's not "personal data" as per GDPR.
  - falcolas 9y ago
    And if a crash report for Firefox/Iceweasel/Chromium/Brave is sent, that contains a memory dump including your username? Seems like enough to make the connection, if someone got ahold of all the data.
    - deleted 9y ago
      [deleted]
    - y0ghur7_xxx 9y ago
      The wrote in the mail that crash reports are anonymised.
      - Aaargh20318 9y ago
        They may well be, the issue is something called re-identification. Even with anonymised data, even when using differential privacy, re-identification can be possible if you're not very careful. The more data you have, the more likely re-identification is.
- cup-of-tea 9y ago
  It's interesting. On its own it won't let you identify anyone, even though it's unique. But if there is out there any database mapping computer configurations to identities then it does. There doesn't seem to be a reason to believe that such a database does not exist.

Santosh83 9y ago

What about crash reports that will be send automatically to Canonical? I hope they would take precautions to scrub personal information from the data before sending them.

Aaargh20318 9y ago

> Nothing in the collected data is "relating to an identified or identifiable natural person", so the checkbox is not even necessary. The data collected could be used to identify a single person. How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? If the data is unique enough, it's PII.

setra 9y ago
A unique random cookie is not PII automatically. It is only PII if it can be associated with something like a name (not limited to a name). Anonymous data with unique identities is not under the consent requirements of the GDPR.
y0ghur7_xxx 9y ago
> The data collected could be used to identify a single person. > How many people have the exact same combination of CPU, amount of RAM, location, disk sizes,GPU vendor/model, disk layout and installed applications ? > If the data is unique enough, it's PII. You can not connect a unique combination of cpu, gpu, disk size, with me, y0ghur7_xxx, if you don't collect my ip address or my name in any other way, so no, it's not "personal data" as per GDPR.
- falcolas 9y ago
  And if a crash report for Firefox/Iceweasel/Chromium/Brave is sent, that contains a memory dump including your username? Seems like enough to make the connection, if someone got ahold of all the data.
  - deleted 9y ago
    [deleted]
  - y0ghur7_xxx 9y ago
    The wrote in the mail that crash reports are anonymised.
    - Aaargh20318 9y ago
      They may well be, the issue is something called re-identification. Even with anonymised data, even when using differential privacy, re-identification can be possible if you're not very careful. The more data you have, the more likely re-identification is.
cup-of-tea 9y ago
It's interesting. On its own it won't let you identify anyone, even though it's unique. But if there is out there any database mapping computer configurations to identities then it does. There doesn't seem to be a reason to believe that such a database does not exist.