4 ms·

Yes. > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the

by Boulth 8y ago

Yes. > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the law. Solution: > Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. Source: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

knorker 8y ago
So you're agreeing? If someone else has the handle->PII mapping then the handle is PII too, and if you can't scrub the handle, then you are in violation of GDPR.
- DennisP 8y ago
  According to the article, you only have to scrub the actual PII, not the pointer to it. A pointer that points to nothing is fine, even if it used to point to PII. And even that is only the case if it's an enterprise holding the PII; if it's out there in the world in a P2P context then the law recognizes that nothing can be done about it.
  - knorker 8y ago
    I'm not so sure. An IP address is PII, not because it's about you but because when combined with other databases identifies you. I'd argue that you're still identifiable if this pointer can be converted to your PII. Even if you point to someone elses database, as long as it's not been scrubbed. Again, IP address is PII even though I don't have address-to-human mappings. My understanding is that this is because their ISP does. Maybe somewhere the word "identifiable" is defined in the legal context? In any case we agree that whatever it means, it will not allow me to outsource PII-storage to China, and have mere random "handles" in their database, right? Because then the law is completely void through a loophole.
    - DennisP 8y ago
      I think the scenario is, you have the PII in your database and the blockchain has "RecordNumber: 123", and then you delete all the PII in record 123 so the it's just a meaningless number. If there's another copy of the PII somewhere, then you haven't deleted it. If the PII was actually public on a P2P network, instead of held by a company, then they're saying the law doesn't apply.
      - knorker 8y ago
        Ok. But why would that be the law? Say my reference number is public on the internet, and the reference number is in a transaction log. That means that the transaction log has information about me, that is not anonymized. Thanks to this reference log you can see my purchase patterns. And isn't "a database of people's purchase patterns" the exact thing GDPR is meant to control?

by Boulth 8y ago

knorker 8y ago

So you're agreeing? If someone else has the handle->PII mapping then the handle is PII too, and if you can't scrub the handle, then you are in violation of GDPR.

DennisP 8y ago
According to the article, you only have to scrub the actual PII, not the pointer to it. A pointer that points to nothing is fine, even if it used to point to PII. And even that is only the case if it's an enterprise holding the PII; if it's out there in the world in a P2P context then the law recognizes that nothing can be done about it.
- knorker 8y ago
  I'm not so sure. An IP address is PII, not because it's about you but because when combined with other databases identifies you. I'd argue that you're still identifiable if this pointer can be converted to your PII. Even if you point to someone elses database, as long as it's not been scrubbed. Again, IP address is PII even though I don't have address-to-human mappings. My understanding is that this is because their ISP does. Maybe somewhere the word "identifiable" is defined in the legal context? In any case we agree that whatever it means, it will not allow me to outsource PII-storage to China, and have mere random "handles" in their database, right? Because then the law is completely void through a loophole.
  - DennisP 8y ago
    I think the scenario is, you have the PII in your database and the blockchain has "RecordNumber: 123", and then you delete all the PII in record 123 so the it's just a meaningless number. If there's another copy of the PII somewhere, then you haven't deleted it. If the PII was actually public on a P2P network, instead of held by a company, then they're saying the law doesn't apply.
    - knorker 8y ago
      Ok. But why would that be the law? Say my reference number is public on the internet, and the reference number is in a transaction log. That means that the transaction log has information about me, that is not anonymized. Thanks to this reference log you can see my purchase patterns. And isn't "a database of people's purchase patterns" the exact thing GDPR is meant to control?