5 ms·
Maybe, maybe not. They record 3 octets of your IP address and the experience is opt-out rather than opt-in. ECJ ruled that IP addresses are PII but did not spec
by setquk 8y ago
Maybe, maybe not. They record 3 octets of your IP address and the experience is opt-out rather than opt-in. ECJ ruled that IP addresses are PII but did not specify if using a partial address is OK. On the basis it is the 3 most significant octets, then this could be used to identify a company or a pool of users or a unique user on an unpopulated network.
Edit: also from [1]: "Hashed MAC address — Determine a cryptographically (SHA256) anonymous and unique ID for a machine. Useful to determine the aggregate number of machines that use .NET Core. This data will not be shared in the public data releases."
I think a machine could be a user in this circumstance? Also a hash isn't anonymous if it's idempotent based on the IP address alone as it's merely a derived value.
[1] https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve-learned-from-net-core-sdk-telemetry/ https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...
- deleted 8y ago[deleted]
- tscs37 8y agoAtleast per german court rulings, which at that time largely covered what is defined as PII under GDPR, say that the full IP is PII but the first three octets is not.
- annabellish 8y agoThe last three octets absolutely could be in conjunction with some other pieces of data, though.
- tscs37 8y agoOf course, yes. Once you can identify a unique person it's personal data, even if you cut of octets. If you only log the IP for example for detecting duplicate accounts, it should be good enough.
- pjc50 8y agoECJ ruling citation please? That would be extremely useful in settling this argument.
- setquk 8y agohttp://curia.europa.eu/juris/document/document.jsf?text=&docid=184668&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1406323 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
- slenk 8y agoIn the US under HIPAA laws, your IP address counts as PHI, not just PII Source: I work in IS for healthcare providers
- zaroth 8y agoNo, an IP on its own is not PHI. IPs must be removed when de-identifying PHI, which is not the same at all as claiming IPs are themselves PHI. [1] - https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#protected https://www.hhs.gov/hipaa/for-professionals/privacy/special-...