5 ms·

Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A u

by lmkg 9y ago

Not really. The GDPR covers "personal data," which is much broader than the category of "personally identifiable information" that other legislation covers. A user identifier, even if opaque and not related to any personal information, counts as personal data.

actuator 9y ago
Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.
- izacus 9y ago
  You've been talking to a bag lawyer then.
- codedokode 9y ago
  > if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.
codedokode 9y ago
Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number. Quote [1]: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

by lmkg 9y ago

actuator 9y ago

Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.

izacus 9y ago
You've been talking to a bag lawyer then.
codedokode 9y ago
> if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.

codedokode 9y ago

Any identifier can be a "personal data" only if it allows to link it to some real person. If you don't store IP address, email, real name, ID card number, SSN, bank card number, phone number, then user id is just a number. Quote [1]: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); [1] https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/