3 ms·

Does GDPR distinguish between "identifiable" data and "non-identifiable"? If so, how do you decide which is which? A list of credit card transactions is pretty

by bo1024 8y ago

Does GDPR distinguish between "identifiable" data and "non-identifiable"? If so, how do you decide which is which? A list of credit card transactions is pretty easy to de-identify...

dx034 8y ago
The information of how many people in a certain age range have shopped at supermarkets in London this week is not identifiable information. So all marketing/spending info they sell is fine. Could only be problematic if it's so granular that you can infer the person.
PeterisP 8y ago
1) GDPR cares only about personally identifiable data, defined in https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ as "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;". Nonidentifiable data or aggregated data (even if derived from private data) are fully out of scope of GDPR if they can't be de-identified. 2) "A list of credit card transactions" is the kind of data that I'd assume that Visa/MC aren't selling to anyone ever, I'd expect any data sales to be on the level of "real time subscription to how (and how much) different demographic groups are shopping in company X or in location Y", but not on the level of individual transactions or individual accounts. Group them by zip-code and hour and you're fine even for GDPR requirements; and you can provide "individual" granularity for the merchants (e.g. for stock traders who want to predict revenues) since merchants generally have no privacy protections.
eyko 8y ago
> Does GDPR distinguish between "identifiable" data and "non-identifiable"?Does GDPR distinguish between "identifiable" data and "non-identifiable"? ico[1] is a useful resource for all GDPR related questions, but to answer your question: yes. Under GDPR, "personal data" is "any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier."[2]. You can also read the "Article 4 - definitions" section in the official regulation doc (pdf)[3]. For the most part, GDPR protections for "personal data" only apply to identifiable data, as would be expected. 1. https://ico.org.uk https://ico.org.uk 2. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/ https://ico.org.uk/for-organisations/guide-to-the-general-da... 3. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
pluma 8y ago
tl;dr: under GDPR terms, anything is "personally identifiable" if you have the means to resolve it. Technically, writing "John Smith" on a piece of paper can become anonymous data if there's no way to determine who wrote it and it doesn't mean anything to anyone who has access to the piece of paper (because there's a lot of people with that name or because they don't know anyone by that name) but of course names should be treated as personally identifiable to be on the safe side. On the other end of the spectrum a vague description like "that chubby guy with the crew cut" can be personally identifiable information if you know who it refers to, even if someone else might see it and have no idea who you mean. So the exact lines are highly contextual and pseudonymisation does not guarantee anonymisation: if you call a Rose by any other name, you still know it's her you're talking about.

by bo1024 8y ago

Does GDPR distinguish between "identifiable" data and "non-identifiable"? If so, how do you decide which is which? A list of credit card transactions is pretty easy to de-identify...

dx034 8y ago

The information of how many people in a certain age range have shopped at supermarkets in London this week is not identifiable information. So all marketing/spending info they sell is fine. Could only be problematic if it's so granular that you can infer the person.

PeterisP 8y ago

1) GDPR cares only about personally identifiable data, defined in https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ as "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;". Nonidentifiable data or aggregated data (even if derived from private data) are fully out of scope of GDPR if they can't be de-identified. 2) "A list of credit card transactions" is the kind of data that I'd assume that Visa/MC aren't selling to anyone ever, I'd expect any data sales to be on the level of "real time subscription to how (and how much) different demographic groups are shopping in company X or in location Y", but not on the level of individual transactions or individual accounts. Group them by zip-code and hour and you're fine even for GDPR requirements; and you can provide "individual" granularity for the merchants (e.g. for stock traders who want to predict revenues) since merchants generally have no privacy protections.

eyko 8y ago

> Does GDPR distinguish between "identifiable" data and "non-identifiable"?Does GDPR distinguish between "identifiable" data and "non-identifiable"? ico[1] is a useful resource for all GDPR related questions, but to answer your question: yes. Under GDPR, "personal data" is "any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier."[2]. You can also read the "Article 4 - definitions" section in the official regulation doc (pdf)[3]. For the most part, GDPR protections for "personal data" only apply to identifiable data, as would be expected. 1. https://ico.org.uk https://ico.org.uk 2. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/ https://ico.org.uk/for-organisations/guide-to-the-general-da... 3. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

pluma 8y ago

tl;dr: under GDPR terms, anything is "personally identifiable" if you have the means to resolve it. Technically, writing "John Smith" on a piece of paper can become anonymous data if there's no way to determine who wrote it and it doesn't mean anything to anyone who has access to the piece of paper (because there's a lot of people with that name or because they don't know anyone by that name) but of course names should be treated as personally identifiable to be on the safe side. On the other end of the spectrum a vague description like "that chubby guy with the crew cut" can be personally identifiable information if you know who it refers to, even if someone else might see it and have no idea who you mean. So the exact lines are highly contextual and pseudonymisation does not guarantee anonymisation: if you call a Rose by any other name, you still know it's her you're talking about.