5 ms·

It concerns me that the site providing information about privacy policies, data subject rights, and privacy laws has a privacy policy that doesn’t even comply w

It concerns me that the site providing information about privacy policies, data subject rights, and privacy laws has a privacy policy that doesn’t even comply with the law. The policy states that they collect “non-identifiable information... which is collected passively using various technologies.” But that’s an incorrect statement of law. Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Also missing a lot of other stuff...

usr1106 8y ago
> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data. An IP address can be personal data under some circumstances. IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.
- dangold 8y ago
  I used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.
- DanBC 8y ago
  It only covers personal data if it can be used to identify a natural person, so your quibble about that not being PII is a bit odd.
eps 8y ago
Might be an interesting idea to hit them with a GDPR data request letter and see how they handle it. Practice what you preach and all that.

usr1106 8y ago

> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data. An IP address can be personal data under some circumstances. IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.

dangold 8y ago
I used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.
DanBC 8y ago
It only covers personal data if it can be used to identify a natural person, so your quibble about that not being PII is a bit odd.

eps 8y ago

Might be an interesting idea to hit them with a GDPR data request letter and see how they handle it. Practice what you preach and all that.