4 ms·

What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal dat

What I've found to be "confusing" is that some GDPR consultants say that when a single person cannot be identified in a blob of data, then it's not personal data. While others say the opposite, any data derived from a single individual is still considered personal data.

merb 8y ago
well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.
DanBC 8y ago
GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.
- JumpCrisscross 8y ago
  > it's personal data if a natural person can be identified from it using reasonable means I could fit a planet into that "reasonable means" caveat.
  - DanBC 8y ago
    That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
    - JumpCrisscross 8y ago
      > It means the regulator can't issue instant fines for non-compliance The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
      - bmer 8y ago
        > The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.) This is classic anti-regulation BS. I would like to see a regulation which did not have this issue brought up against it. Heck, isn't this the core of the anti-regulation camp? Clearly though, regulations have not destroyed the world...
      - ckastner 8y ago
        > The regulator interprets the gap. Technically, it will be the courts who (ultimately) interpret the gap, and it's worked so far for other standards like 'beyond reasonable doubt'. Courts have a tendency to be less capricious than a regulator. I'd even go so far as to argue that "reason" is one of those things where specific examples can illustrate, but no more. Especially with regards to technology -- what is reasonable today, can be unreasonable tomorrow (eg: SHA1). In the meantime, I'm positive that as of right now, 99% of the interpretation is performed by the data processors, and in most cases to their own benefit.
- ithkuil 8y ago
  What is a reasonable mean? Imaginr you can take 100 blobs of data, and for each blob it's really hard to get a fix on a particular person, but combined through a magic probabilistic heuristic yields predictions that are "good enough" to extract value from. Does the mere existence of this "join" trick make your individual blobs personal data? Or only once your company actually implements the join?
  - DanBC 8y ago
    > magic probabilistic Use of magic moves it from reasonable to improbable.
    - tedunangst 8y ago
      Are neural nets magic?
  - bmer 8y ago
    Reasonable means for example, this: https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-10/cp160112en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201... Dynamic IPs were considered as possibly being personal info, since a law existed which could allow an entity to connect dynamic IPs they have connected to other information (from an ISP), if they believe that connections from the dynamic IP are undertaking cyberattacks against them. Proto-GDPR actually considered collecting dynamic IPs in this case reasonable, and it was a specific German law that was more restrictive. The main question thus became: should proto-GDPR be used, or the existing more restrictive German law? Going off topic though. Point is that "reasonable" is used not as a mathematically precise definition, but in a human language sense of "reasonable". If you don't get what reasonable means, then I am sorry to say that in the case of law, you will generally have to suffer what most people consider to be reasonable in spirit. In other words, you have a problem with all laws in general, since they are not nearly precise enough for you.
  - toadworrier 8y ago
    > What is a reasonable mean? Be reasonable! Just as even interpreted software must eventually appeal to hardware actions to give them meaning, laws must eventually appeal to human-judged concepts, including reasonabless. A definition like the one above actually strikes a good balance. It leaves it up to courts faced with real situations to evolve rules about what constitutes "reasonable"; while giving those courts a definite thing to judge the reasonableness of.

merb 8y ago

well under the eu gdpr no data is called personal data if it is immpossible with the data to identify a person/company/person of law.

DanBC 8y ago

GDPR seems clear on this: it's personal data if a natural person can be identified from it using reasonable means.

JumpCrisscross 8y ago
> it's personal data if a natural person can be identified from it using reasonable means I could fit a planet into that "reasonable means" caveat.
- DanBC 8y ago
  That's a good thing. It means the regulator can't issue instant fines for non-compliance except in the very worst most obvious cases. Because of this planet sized gap they need to ask everyone else to come into compliance before issuing the fine.
  - JumpCrisscross 8y ago
    > It means the regulator can't issue instant fines for non-compliance The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.)
    - bmer 8y ago
      > The regulator interprets the gap. "Planet-sized gap" means the regulator can choose to be lenient or capricious based on their own preferences. That kind of uncertainty is anathema for modern businesses. (It's also beneficial to those who pay to build relationships with said regulators.) This is classic anti-regulation BS. I would like to see a regulation which did not have this issue brought up against it. Heck, isn't this the core of the anti-regulation camp? Clearly though, regulations have not destroyed the world...
    - ckastner 8y ago
      > The regulator interprets the gap. Technically, it will be the courts who (ultimately) interpret the gap, and it's worked so far for other standards like 'beyond reasonable doubt'. Courts have a tendency to be less capricious than a regulator. I'd even go so far as to argue that "reason" is one of those things where specific examples can illustrate, but no more. Especially with regards to technology -- what is reasonable today, can be unreasonable tomorrow (eg: SHA1). In the meantime, I'm positive that as of right now, 99% of the interpretation is performed by the data processors, and in most cases to their own benefit.
ithkuil 8y ago
What is a reasonable mean? Imaginr you can take 100 blobs of data, and for each blob it's really hard to get a fix on a particular person, but combined through a magic probabilistic heuristic yields predictions that are "good enough" to extract value from. Does the mere existence of this "join" trick make your individual blobs personal data? Or only once your company actually implements the join?
- DanBC 8y ago
  > magic probabilistic Use of magic moves it from reasonable to improbable.
  - tedunangst 8y ago
    Are neural nets magic?
- bmer 8y ago
  Reasonable means for example, this: https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-10/cp160112en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201... Dynamic IPs were considered as possibly being personal info, since a law existed which could allow an entity to connect dynamic IPs they have connected to other information (from an ISP), if they believe that connections from the dynamic IP are undertaking cyberattacks against them. Proto-GDPR actually considered collecting dynamic IPs in this case reasonable, and it was a specific German law that was more restrictive. The main question thus became: should proto-GDPR be used, or the existing more restrictive German law? Going off topic though. Point is that "reasonable" is used not as a mathematically precise definition, but in a human language sense of "reasonable". If you don't get what reasonable means, then I am sorry to say that in the case of law, you will generally have to suffer what most people consider to be reasonable in spirit. In other words, you have a problem with all laws in general, since they are not nearly precise enough for you.
- toadworrier 8y ago
  > What is a reasonable mean? Be reasonable! Just as even interpreted software must eventually appeal to hardware actions to give them meaning, laws must eventually appeal to human-judged concepts, including reasonabless. A definition like the one above actually strikes a good balance. It leaves it up to courts faced with real situations to evolve rules about what constitutes "reasonable"; while giving those courts a definite thing to judge the reasonableness of.