4 ms·

Why would you keep the ip-adress in the first place? If it is for fraud-prevention, then that is sufficient reason to keep it unanonymised...

nickpp 8y ago
3 reasons to keep the IP: statistics, analytics, and fraud prevention. Anonymizing it does not seem to solve anything, since the anonymized version "can be used to build a profile" so "it's PII"...
- hvidgaard 8y ago
  If the information can be used to build a profile linked to me, it's PII. If you do not and cannot link it to me, then it's no longer PII. That is kinda in the name, Personally Identifiable Information. In short, if the collection of information can point to me, it's PII. If it cannot point to me it's not PII.
  - StupidOne 8y ago
    Problem is, if we take it to extreme, we are basically playing Cluedo game. Is "18 year old" PII? - no Is "orders pizza every Friday" PII? - no Is "always misspells word cheese" PII? - no Is "leaves 10% tip" PII? - no Combine it and you have PII.
    - hvidgaard 8y ago
      And rightfully so. If the collection points to me, then it's PII. Anonymized it might be "is between 18-25 years old", "orders fast food once a week", "tips between 0-10%". Just because something it murky, doesn't mean businesses get to ignore it. The entire point is to force companies to actually think about what their data is and decide if they need to store PII. If they do it have implications. Have a reasonable explanation for choices, and are willing to rectify issues pointed out by consumers and/or DPA.
- oAlbe 8y ago
  > 3 reasons to keep the IP: statistics, analytics That's exactly why GDPR is a good thing. It prevents anybody from doing statistics and keeping analytics about the users. Want to collect this information in order to profile your users and offer them a better product (ndr. better ads)? Well tough luck. You either anonymize and stop profiling and tracking your users or you close shop in Europe. I don't see how this is a bad thing in any possible way. You say it costs money? I guess then some of the money they made by targeting users and selling their personal data so far can be put to good use.
  - nickpp 8y ago
    Please note I was NOT talking about selling personal data, ads or ad-targeting in any way. Just regular analytics and statistics of usage and environment to simply improve the product.
  - Mirioron 8y ago
    Have a login system? You're likely storing email addresses, which are considered personal data.
    - xyzzyz 8y ago
      If the user gives you their email address to register, you can ask them for consent to store it. In fact, most European websites that collect any kind of personal data have already been doing this for over a decade.

nickpp 8y ago

3 reasons to keep the IP: statistics, analytics, and fraud prevention. Anonymizing it does not seem to solve anything, since the anonymized version "can be used to build a profile" so "it's PII"...

hvidgaard 8y ago
If the information can be used to build a profile linked to me, it's PII. If you do not and cannot link it to me, then it's no longer PII. That is kinda in the name, Personally Identifiable Information. In short, if the collection of information can point to me, it's PII. If it cannot point to me it's not PII.
- StupidOne 8y ago
  Problem is, if we take it to extreme, we are basically playing Cluedo game. Is "18 year old" PII? - no Is "orders pizza every Friday" PII? - no Is "always misspells word cheese" PII? - no Is "leaves 10% tip" PII? - no Combine it and you have PII.
  - hvidgaard 8y ago
    And rightfully so. If the collection points to me, then it's PII. Anonymized it might be "is between 18-25 years old", "orders fast food once a week", "tips between 0-10%". Just because something it murky, doesn't mean businesses get to ignore it. The entire point is to force companies to actually think about what their data is and decide if they need to store PII. If they do it have implications. Have a reasonable explanation for choices, and are willing to rectify issues pointed out by consumers and/or DPA.
oAlbe 8y ago
> 3 reasons to keep the IP: statistics, analytics That's exactly why GDPR is a good thing. It prevents anybody from doing statistics and keeping analytics about the users. Want to collect this information in order to profile your users and offer them a better product (ndr. better ads)? Well tough luck. You either anonymize and stop profiling and tracking your users or you close shop in Europe. I don't see how this is a bad thing in any possible way. You say it costs money? I guess then some of the money they made by targeting users and selling their personal data so far can be put to good use.
- nickpp 8y ago
  Please note I was NOT talking about selling personal data, ads or ad-targeting in any way. Just regular analytics and statistics of usage and environment to simply improve the product.
- Mirioron 8y ago
  Have a login system? You're likely storing email addresses, which are considered personal data.
  - xyzzyz 8y ago
    If the user gives you their email address to register, you can ask them for consent to store it. In fact, most European websites that collect any kind of personal data have already been doing this for over a decade.