6 ms·

> Because it contains no data that can directly identify an individual, pseudonymous data may represent a lower risk of privacy impact in the event of an uninte

> Because it contains no data that can directly identify an individual, pseudonymous data may represent a lower risk of privacy impact in the event of an unintended disclosure.. This is playing with fire when it comes to GDPR. 'PII' for GDPR is interpreted much more broadly, and includes any information that could feasibly be used to identify an individual (even IP addresses!). Swapping out the names alone probably wouldn't cover you, and anyway isn't in the spirit of the legislation, which is to give customers more control over their data [1]. While no doubt this would be a boon to AdTech brands that by and large don't care about the name of a customer, but very much want to be able to sync data without customer consent, this seems a little too cute. https://www.gigya.com/blog/gdpr-difference-between-personal-data-and-personally-identifiable-information/ https://www.gigya.com/blog/gdpr-difference-between-personal-...

amygdyl 9y ago
Adtech research dept. here: totally correct, the abstraction gets laughed at by the abstraction known as the box model of contracts, arm's length principles, the classic Entores case (by showing you are the sender and receiver of the transaction, eliminating any fungibility of liability you might argue is transferred to the supposedly impenetrable pseuse-anon algo) and from the selection remaining, which is a whack-a-mole guessing game here, I most like the idea of tort of damages to the value of character rights by bad faith interference with the potential value of the individual's exchange of use of their identifying characteristics for the provision of services, namely you may advertise to me, knowing something about me which I am prepared to disclose, in return for my reading your content: slurping the description of my character for use by third parties is unlawful. (Edit, typo)
softawre 9y ago
This concept is specifically mentioned in the law text. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ > the existence of appropriate safeguards, which may include encryption or pseudonymisation.
- kristianc 9y ago
  You can see from the law text that the definition of personal data is much wider than is traditionally applied in the US. > Art 4.1 - ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. [1] Pseudonymization may provide a get-out if the subject of the processing is not identifiable by any of those other means, but it is by no means sufficient on its own. [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
  - softawre 9y ago
    I agree, it may protect you. Consult your lawyer. Or, in my companies case, just build out the tools to let people delete all of the data we don't absolutely need.

amygdyl 9y ago

Adtech research dept. here: totally correct, the abstraction gets laughed at by the abstraction known as the box model of contracts, arm's length principles, the classic Entores case (by showing you are the sender and receiver of the transaction, eliminating any fungibility of liability you might argue is transferred to the supposedly impenetrable pseuse-anon algo) and from the selection remaining, which is a whack-a-mole guessing game here, I most like the idea of tort of damages to the value of character rights by bad faith interference with the potential value of the individual's exchange of use of their identifying characteristics for the provision of services, namely you may advertise to me, knowing something about me which I am prepared to disclose, in return for my reading your content: slurping the description of my character for use by third parties is unlawful. (Edit, typo)

softawre 9y ago

This concept is specifically mentioned in the law text. https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ > the existence of appropriate safeguards, which may include encryption or pseudonymisation.

kristianc 9y ago
You can see from the law text that the definition of personal data is much wider than is traditionally applied in the US. > Art 4.1 - ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. [1] Pseudonymization may provide a get-out if the subject of the processing is not identifiable by any of those other means, but it is by no means sufficient on its own. [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- softawre 9y ago
  I agree, it may protect you. Consult your lawyer. Or, in my companies case, just build out the tools to let people delete all of the data we don't absolutely need.