6 ms·

That’s already the definition used in many contexts.

dahart 8y ago
What contexts are you thinking of? I’d agree in the context of discussing de-anonymizing data. But all the policy, e.g., GDPR, and licenses that I’ve seen so far mean specifically 100% directly identifiable (such as name & address or SSN) when they say “personally identifiable information”, and especially when they use the acronym PII.
- DanBC 8y ago
  No, that's not what GDPR says. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...] > ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
  - dahart 8y ago
    Yeah you’re right. I stand corrected, and I even read that section last week.
- mysterydip 8y ago
  One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.
- mrmr1993 8y ago
  From GDPR Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; To layer on some interpretation: * Red Shell is collecting information * which relates to "an identifiable natural person" * who "can be identified [...] by reference to [...] one or more factors specific to the physical [...] identity of that natural person" * where these factors are the information Red Shell is collecting about the software and hardware of their physical devices * and thus are "personal data", as regulated by the GDPR. Given that their primary purpose is identifying users, they're going to have a hard time arguing that they don't fall under the GDPR's jurisdiction.

What contexts are you thinking of? I’d agree in the context of discussing de-anonymizing data. But all the policy, e.g., GDPR, and licenses that I’ve seen so far mean specifically 100% directly identifiable (such as name & address or SSN) when they say “personally identifiable information”, and especially when they use the acronym PII.

DanBC 8y ago
No, that's not what GDPR says. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...] > ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
- dahart 8y ago
  Yeah you’re right. I stand corrected, and I even read that section last week.
mysterydip 8y ago
One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.
mrmr1993 8y ago
From GDPR Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; To layer on some interpretation: * Red Shell is collecting information * which relates to "an identifiable natural person" * who "can be identified [...] by reference to [...] one or more factors specific to the physical [...] identity of that natural person" * where these factors are the information Red Shell is collecting about the software and hardware of their physical devices * and thus are "personal data", as regulated by the GDPR. Given that their primary purpose is identifying users, they're going to have a hard time arguing that they don't fall under the GDPR's jurisdiction.