5 ms·

Someone on reddit noted that this may be true for one more reason: the law does not allow automatic profiling of the user (Article 22) > The data subject shall

Someone on reddit noted that this may be true for one more reason: the law does not allow automatic profiling of the user (Article 22) > The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

deleted 8y ago
[deleted]
x0x0 8y ago
That quote is incoherent. Your quote -- clause 1 from A22 -- indeed points out that profiling is permitted under circumstances enumerated at the end. Further, the GDPR has rules around two things you mention, but they are different: (1) profiling; (2) automated decision making. Profiling has three elements, as described by the A29 WG: * An automated form of processing. * Carried out on personal data. * For the objective of evaluating personal aspects about a natural person. As for IP addresses, mapping them to an ASN is fully anonymized. Since an anonymized IP address is not personal data, using it is not profiling. Blocking users from using your site is highly unlikely to have the "legal effects" enumerated in the above clause.
eganist 8y ago
"Article 4 (4): ‘profiling’ means any form of automated processing of personal data" CJEU case law has determined that IP addresses are not considered "personal data" except in certain cases (https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...) > The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if: > 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and > 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. > On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD. The vast majority of entities do not meet the requirements for #2. Therefore, automatic profiling rules could not apply since the automatic analysis being performed is not against personal data.
- zerostar07 8y ago
  I hope that IPs will stop being considered PII for the same reason. It's much easier to anonymize them at the ISP level rather than doing all these acrobatics.
jon__k 8y ago
> the law does not allow automatic profiling of the user (Article 22) GEO-IP is not a profile unless it is stored with additional data.

deleted 8y ago

[deleted]

x0x0 8y ago

That quote is incoherent. Your quote -- clause 1 from A22 -- indeed points out that profiling is permitted under circumstances enumerated at the end. Further, the GDPR has rules around two things you mention, but they are different: (1) profiling; (2) automated decision making. Profiling has three elements, as described by the A29 WG: * An automated form of processing. * Carried out on personal data. * For the objective of evaluating personal aspects about a natural person. As for IP addresses, mapping them to an ASN is fully anonymized. Since an anonymized IP address is not personal data, using it is not profiling. Blocking users from using your site is highly unlikely to have the "legal effects" enumerated in the above clause.

eganist 8y ago

"Article 4 (4): ‘profiling’ means any form of automated processing of personal data" CJEU case law has determined that IP addresses are not considered "personal data" except in certain cases (https://www.whitecase.com/publications/alert/court-confirms-ip-addresses-are-personal-data-some-cases https://www.whitecase.com/publications/alert/court-confirms-...) > The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if: > 1. there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and > 2. the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. > On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD. The vast majority of entities do not meet the requirements for #2. Therefore, automatic profiling rules could not apply since the automatic analysis being performed is not against personal data.

zerostar07 8y ago
I hope that IPs will stop being considered PII for the same reason. It's much easier to anonymize them at the ISP level rather than doing all these acrobatics.

jon__k 8y ago

> the law does not allow automatic profiling of the user (Article 22) GEO-IP is not a profile unless it is stored with additional data.