6 ms·

>"People can have their own opinions on it but our data is not personally identifiable information (PII)," Err..isn't the point of this exercise to have enough

>"People can have their own opinions on it but our data is not personally identifiable information (PII)," Err..isn't the point of this exercise to have enough data to identify who bought the game and why? I feel the exact kind of computer I use and the various customizations that lead to it being a unique machine are very personal and identifiable.

zimbatm 8y ago
That's the whole game, pretend that the information is not personally identifiable but it's just one lookup away when the person uses his credit card on any website that is part of the net.
- nerdponx 8y ago
  The definition of PII needs to be expanded to "combinations of attributes that can uniquely identify a single individual with high probability."
  - mrmr1993 8y ago
    For the EU, the definition in the GDPR should cover this. From Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  - daxelrod 8y ago
    That’s already the definition used in many contexts.
    - dahart 8y ago
      What contexts are you thinking of? I’d agree in the context of discussing de-anonymizing data. But all the policy, e.g., GDPR, and licenses that I’ve seen so far mean specifically 100% directly identifiable (such as name & address or SSN) when they say “personally identifiable information”, and especially when they use the acronym PII.
      - DanBC 8y ago
        No, that's not what GDPR says. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...] > ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
        dahart 8y ago
        Yeah you’re right. I stand corrected, and I even read that section last week.
      - mysterydip 8y ago
        One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.
      - mrmr1993 8y ago
        From GDPR Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; To layer on some interpretation: * Red Shell is collecting information * which relates to "an identifiable natural person" * who "can be identified [...] by reference to [...] one or more factors specific to the physical [...] identity of that natural person" * where these factors are the information Red Shell is collecting about the software and hardware of their physical devices * and thus are "personal data", as regulated by the GDPR. Given that their primary purpose is identifying users, they're going to have a hard time arguing that they don't fall under the GDPR's jurisdiction.
  - deleted 8y ago
    [deleted]
  - tonyarkles 8y ago
    I'm a fun example here too. Through a quirk of how addresses are assigned in my city, and how postal codes are assigned in Canada, my house has a unique postal code. Given our postal code, you have 100% certainty, and 50% probability between me or my partner.
- Cthulhu_ 8y ago
  A famous experiment was when Yahoo (I think) released a dump of anonymised search queries, however, they had a user identifier for each query so it was simple enough to combine the queries and find the person.
  - ryandrake 8y ago
    It was AOL, but yea, they didn't really think their method of "anonymizing the data" through.
- manicdee 8y ago
  Just the fact that I browse exclusively in private mode from Australia, don't accept third party cookies, apparently have Ghostery installed and use Safari vX.Y is enough to narrow down my identity to about one person give or take. The information collected in this program is more than enough to identify me personally, and probably enough to start making some kind of psychological profile to help them predict how to convince me to vote for Donald Trump (or in my case, a Liberal Party member).
black_puppydog 8y ago
They "just" have a profile of "a person" that happens to match you to the last tiny detail. They don't put your name as a label onto that data, so it's "not" identifiable. Makes no difference for marketing purposes if they don't want to address you by name. But yeah, once linked to your name by one of those manymany data points they collected, it is very personal....
- organsnyder 8y ago
  That would be considered PII at the healthcare organization I work for.
  - mattnewton 8y ago
    Because the people who work in the heath industry understand all usually all it takes is a name and some tiny fact like your adresss to unmask the dataset after the fact.
    - reaperducer 8y ago
      Because the health care industry has enough money to hire the best lawyers to advise on this sort of thing.
      - tjoff 8y ago
        It really is common sense though. You only need good lawyers if you are trying to game it.
      - mattnewton 8y ago
        I don’t think it’s about availability of money, companies don’t spend money they don’t have to. INAL but I believe it’s about HIPAA and related legislation making it their liability.
- sdoering 8y ago
  Regarding the GDPR this is PII. They can squeel and wiggle. But as the use a thing called the internet to transfer this data, they receive something like an IP address. And that is PII. It wouldn't be a problem to collect that. If I am informed as well as have the (easy) ability to opt out. Did they collect after 25. of May? Wouldn't they be liable regarding GDPR?
Flammy 8y ago
No, the point is to collect enough info to link a user who launched the game to someone who clicked an ad. The problem Red Shell is trying to solve is the "download divide" -- You can track clicks/users on the web before they download, and you can track them after they launch your product, but you can't easily connect the two. As for why devs want this, if you know ad campaign 1 cost $1 and had 2000 clicks, and ad campaign 2 cost #1 had 1000 clicks, that is helpul but what you really want to know is "what is the lifetime value (LTV) vs cost of acquisition of users from campaign 1 vs 2" because if LTV is significantly different then despite higher cost it may clearly be worth it. But if you can't connect a user from before the download to after you can't do this sort of calculation. Devs really don't care who the users are, we just want to know how effective a campaign is compared to one another. Source: Was planning on integrating Red Shell ourselves before this (false) outrage made us cancel our plans.
- rostigerpudel 8y ago
  While I agree that is what they officially say they do, the means employed go beyond that. From the article: > "These are generally data points about the user’s device, such as its operating system, installed fonts, browsers (and versions) used, timezone, language, the user’s in-game ID, and screen resolution. This is what Red Shell calls a ‘fingerprint’, which can also be made on games consoles as well as PCs." Such a fingerprint is very unique and can easily be connected to a person with very little effort down the line, even if now nobody does that (yeah, right). Personally, I do not trust any company that collects such detailed information without my informed consent and without a clear (i.e. verifiable and legally enforceable) pledge to delete that information when the original purpose has been served. This is exactly the overshooting behaviour that was rightfully targeted by the Europeans with their recent data protection law. edit: formatting
  - Flammy 8y ago
    That is correct. Red Shell also specifies to devs you should configure it to report some of those and not all should be reported. It provides guidelines for how many to report based on how many unique users you have/are expecting. All of these factors are available to web browsers (which is why they were chosen, so they can be matched up to web clicks). These are tracked in most web analytics suites today by default. Based on my research I don't believe that these (even all of them together) are PII.
FussyZeus 8y ago
If the data isn't at least somewhat identifiable, then how is it actionable? This is why I roll my eyes back into my head every time some marketing suit says "well we anonymize the information" and it's just flat out ridiculous if you think about it, if the information was properly anonymized, then IT COULDN'T BE USED FOR AD TARGETING. Full. Stop. So if the data collection is for ad targeting, then it's identifiable because it can't not be otherwise it would be useless for the thing it's collected for.
- avarun 8y ago
  It's not being used for ad targeting. It's being used to track ad conversions, which is a completely different thing and can be done without PII.
  - actsasbuffoon 8y ago
    A web cookie can in some circumstances be considered PII: https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...
duxup 8y ago
>"People can have their own opinions on it but our data is not personally identifiable information (PII),"* *We sell it to others who do that!

zimbatm 8y ago

That's the whole game, pretend that the information is not personally identifiable but it's just one lookup away when the person uses his credit card on any website that is part of the net.

nerdponx 8y ago
The definition of PII needs to be expanded to "combinations of attributes that can uniquely identify a single individual with high probability."
- mrmr1993 8y ago
  For the EU, the definition in the GDPR should cover this. From Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- daxelrod 8y ago
  That’s already the definition used in many contexts.
  - dahart 8y ago
    What contexts are you thinking of? I’d agree in the context of discussing de-anonymizing data. But all the policy, e.g., GDPR, and licenses that I’ve seen so far mean specifically 100% directly identifiable (such as name & address or SSN) when they say “personally identifiable information”, and especially when they use the acronym PII.
    - DanBC 8y ago
      No, that's not what GDPR says. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...] > ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
      - dahart 8y ago
        Yeah you’re right. I stand corrected, and I even read that section last week.
    - mysterydip 8y ago
      One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.
    - mrmr1993 8y ago
      From GDPR Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; To layer on some interpretation: * Red Shell is collecting information * which relates to "an identifiable natural person" * who "can be identified [...] by reference to [...] one or more factors specific to the physical [...] identity of that natural person" * where these factors are the information Red Shell is collecting about the software and hardware of their physical devices * and thus are "personal data", as regulated by the GDPR. Given that their primary purpose is identifying users, they're going to have a hard time arguing that they don't fall under the GDPR's jurisdiction.
- deleted 8y ago
  [deleted]
- tonyarkles 8y ago
  I'm a fun example here too. Through a quirk of how addresses are assigned in my city, and how postal codes are assigned in Canada, my house has a unique postal code. Given our postal code, you have 100% certainty, and 50% probability between me or my partner.
Cthulhu_ 8y ago
A famous experiment was when Yahoo (I think) released a dump of anonymised search queries, however, they had a user identifier for each query so it was simple enough to combine the queries and find the person.
- ryandrake 8y ago
  It was AOL, but yea, they didn't really think their method of "anonymizing the data" through.
manicdee 8y ago
Just the fact that I browse exclusively in private mode from Australia, don't accept third party cookies, apparently have Ghostery installed and use Safari vX.Y is enough to narrow down my identity to about one person give or take. The information collected in this program is more than enough to identify me personally, and probably enough to start making some kind of psychological profile to help them predict how to convince me to vote for Donald Trump (or in my case, a Liberal Party member).

black_puppydog 8y ago

They "just" have a profile of "a person" that happens to match you to the last tiny detail. They don't put your name as a label onto that data, so it's "not" identifiable. Makes no difference for marketing purposes if they don't want to address you by name. But yeah, once linked to your name by one of those manymany data points they collected, it is very personal....

organsnyder 8y ago
That would be considered PII at the healthcare organization I work for.
- mattnewton 8y ago
  Because the people who work in the heath industry understand all usually all it takes is a name and some tiny fact like your adresss to unmask the dataset after the fact.
  - reaperducer 8y ago
    Because the health care industry has enough money to hire the best lawyers to advise on this sort of thing.
    - tjoff 8y ago
      It really is common sense though. You only need good lawyers if you are trying to game it.
    - mattnewton 8y ago
      I don’t think it’s about availability of money, companies don’t spend money they don’t have to. INAL but I believe it’s about HIPAA and related legislation making it their liability.
sdoering 8y ago
Regarding the GDPR this is PII. They can squeel and wiggle. But as the use a thing called the internet to transfer this data, they receive something like an IP address. And that is PII. It wouldn't be a problem to collect that. If I am informed as well as have the (easy) ability to opt out. Did they collect after 25. of May? Wouldn't they be liable regarding GDPR?

Flammy 8y ago

No, the point is to collect enough info to link a user who launched the game to someone who clicked an ad. The problem Red Shell is trying to solve is the "download divide" -- You can track clicks/users on the web before they download, and you can track them after they launch your product, but you can't easily connect the two. As for why devs want this, if you know ad campaign 1 cost $1 and had 2000 clicks, and ad campaign 2 cost #1 had 1000 clicks, that is helpul but what you really want to know is "what is the lifetime value (LTV) vs cost of acquisition of users from campaign 1 vs 2" because if LTV is significantly different then despite higher cost it may clearly be worth it. But if you can't connect a user from before the download to after you can't do this sort of calculation. Devs really don't care who the users are, we just want to know how effective a campaign is compared to one another. Source: Was planning on integrating Red Shell ourselves before this (false) outrage made us cancel our plans.

rostigerpudel 8y ago
While I agree that is what they officially say they do, the means employed go beyond that. From the article: > "These are generally data points about the user’s device, such as its operating system, installed fonts, browsers (and versions) used, timezone, language, the user’s in-game ID, and screen resolution. This is what Red Shell calls a ‘fingerprint’, which can also be made on games consoles as well as PCs." Such a fingerprint is very unique and can easily be connected to a person with very little effort down the line, even if now nobody does that (yeah, right). Personally, I do not trust any company that collects such detailed information without my informed consent and without a clear (i.e. verifiable and legally enforceable) pledge to delete that information when the original purpose has been served. This is exactly the overshooting behaviour that was rightfully targeted by the Europeans with their recent data protection law. edit: formatting
- Flammy 8y ago
  That is correct. Red Shell also specifies to devs you should configure it to report some of those and not all should be reported. It provides guidelines for how many to report based on how many unique users you have/are expecting. All of these factors are available to web browsers (which is why they were chosen, so they can be matched up to web clicks). These are tracked in most web analytics suites today by default. Based on my research I don't believe that these (even all of them together) are PII.

FussyZeus 8y ago

If the data isn't at least somewhat identifiable, then how is it actionable? This is why I roll my eyes back into my head every time some marketing suit says "well we anonymize the information" and it's just flat out ridiculous if you think about it, if the information was properly anonymized, then IT COULDN'T BE USED FOR AD TARGETING. Full. Stop. So if the data collection is for ad targeting, then it's identifiable because it can't not be otherwise it would be useless for the thing it's collected for.

avarun 8y ago
It's not being used for ad targeting. It's being used to track ad conversions, which is a completely different thing and can be done without PII.
- actsasbuffoon 8y ago
  A web cookie can in some circumstances be considered PII: https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...

duxup 8y ago

>"People can have their own opinions on it but our data is not personally identifiable information (PII),"* *We sell it to others who do that!