7 ms·
From their perspective, they claim that it is not personal info since it's anonymised. On that, they're right. But it still makes a shitty user experience to d
by fiiv 8y ago
From their perspective, they claim that it is not personal info since it's anonymised. On that, they're right.
But it still makes a shitty user experience to do something that is counter to what your users expect and want.
- setquk 8y agoMaybe, maybe not. They record 3 octets of your IP address and the experience is opt-out rather than opt-in. ECJ ruled that IP addresses are PII but did not specify if using a partial address is OK. On the basis it is the 3 most significant octets, then this could be used to identify a company or a pool of users or a unique user on an unpopulated network. Edit: also from [1]: "Hashed MAC address — Determine a cryptographically (SHA256) anonymous and unique ID for a machine. Useful to determine the aggregate number of machines that use .NET Core. This data will not be shared in the public data releases." I think a machine could be a user in this circumstance? Also a hash isn't anonymous if it's idempotent based on the IP address alone as it's merely a derived value. [1] https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- deleted 8y ago[deleted]
- tscs37 8y agoAtleast per german court rulings, which at that time largely covered what is defined as PII under GDPR, say that the full IP is PII but the first three octets is not.
- annabellish 8y agoThe last three octets absolutely could be in conjunction with some other pieces of data, though.
- tscs37 8y agoOf course, yes. Once you can identify a unique person it's personal data, even if you cut of octets. If you only log the IP for example for detecting duplicate accounts, it should be good enough.
- pjc50 8y agoECJ ruling citation please? That would be extremely useful in settling this argument.
- setquk 8y agohttp://curia.europa.eu/juris/document/document.jsf?text=&docid=184668&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1406323 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
- slenk 8y agoIn the US under HIPAA laws, your IP address counts as PHI, not just PII Source: I work in IS for healthcare providers
- zaroth 8y agoNo, an IP on its own is not PHI. IPs must be removed when de-identifying PHI, which is not the same at all as claiming IPs are themselves PHI. [1] - https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#protected https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
- jacques_chester 8y ago> But it still makes a shitty user experience to do something that is counter to what your users expect and want. One way to improve shitty user experiences is to study them. This requires information. How do I answer questions like: what is the most frequently-used command? Which command causes the most people to give up? Which argument is being asked for, which already exists? What effect does a change in documentation have? How many projects do people work on and do we need to invest in tools for repositories with many projects? Etc etc. This is all Product Management 101: form hypothesis and test it.
- ptx 8y agoYou could answer such questions the usual established way it's normally done in other fields: sample a voluntarily participating statistically significant subset of the population.
- jacques_chester 8y agoOther fields do this when there is no better alternative. It's is orders of magnitudes more expensive and also, more to the point, quite unreliable.
- ringbugger 8y agoWould be great to give the user an option to send statistics or something like that to do just that. I really like VSC. But things like this really question all the positive experience. I doubt product management is going to help here. Will now scan network transfer VSC is causing. In many other cases I wouldn't even bother anymore.
- jacques_chester 8y ago> Would be great to give the user an option to send statistics or something like that to do just that. This is exactly what they do.