4 ms·
I couldn't disagree more with your understanding of the legislation. If I discovered your company was storing my personal data under "unique keys" that conside
by erichocean 8y ago
I couldn't disagree more with your understanding of the legislation.
If I discovered your company was storing my personal data under "unique keys" that considered by themselves didn't personally identify me, I'd report you to my GDPR regulator immediately.
Unique keys with no personally-identifiable data in the key aren't some sort of innovative workaround that will allow you to store my personal data without my consent. It's not even remotely consistent with the spirit of the law, and IMO, with the plain text of the legislation.
- jdietrich 8y agoIf data is stripped of all identifiers that could be used to associate it with a natural person by any reasonable means, then it isn't personal data. If a unique key could in any way be used to identify a natural person, even indirectly, then it constitutes an identifier and any data associated with it is personal data. https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/ A salted hash of your IP address is an identifier, because it can be used to indirectly identify a natural person. If I see the same IP again, I can hash it with the same salt and check for a match. The IP can then be used to identify you through your ISP's DHCP logs. If I associate the hash value with any other data, then that data becomes personal data. If I delete the salt value, then it's impossible for me to match the hash to an IP, so the hash ceases to be an identifier. Assuming that the data associated with that hash does not contain any other identifiers, or data that when combined in aggregate could identify a natural person, then it ceases to be personal data.