4 ms·
> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and c
by usr1106 8y ago
> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws.
Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data.
An IP address can be personal data under some circumstances.
IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.
- dangold 8y agoI used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.
- DanBC 8y agoIt only covers personal data if it can be used to identify a natural person, so your quibble about that not being PII is a bit odd.