6 ms·

Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things

Yeah, and the crazy thing is if you talk with a lawyer they would label anything and everything as personal data just because of how abstract some of the things are in the regulation. For example, IP address is PII and if you derive city, region or country from that it becomes personal data. Now if you are a small project or startup there is high chance that you are using some of the external analytics tools like GA or mixpanel(as building a good analytics tool is an effort on its own). Now you have to take care of data like country there as well and be very careful that you delete data like this as well.

izacus 9y ago
You've been talking to a bag lawyer then.
codedokode 9y ago
> if you derive city, region or country from that it becomes personal data I don't think city itself is a personal data. You could use user's IP address to get the city and then discard it and this way you know user's city but don't have to keep their IP address. Google Analytics can be a problem; Google or someone else should make the analytics that doesn't store IP addresses. And I think ISPs should randomly rotate IP addresses of their customers so they cannot be used for identification.