3 ms·

GDPR has a broader definition of PII than is used in the US, and includes any data that can potentially be used to identify an individual (even IP address), so

GDPR has a broader definition of PII than is used in the US, and includes any data that can potentially be used to identify an individual (even IP address), so it’s almost certain that it is within scope.

gumby 8y ago
Here is the actual text of GDPR (there are many sites, hosted at .eu domains, that claim to tell you what the legislation says, but why not read the published law? (I chose English as HN is an English-language site): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32... ) My read is that the text of the law doesn't apply to people acting on behalf of a corporation, in their corporate persona (but this is why I linked to the text itself and not someone else's interpretation. It's not that long). The law talks about identifying a person in their personal sphere (doesn't apply to being in your home; talks about ties to fundamental human rights, genetic and health info, etc) or things like credit approval, and many many many exceptions for "national security" an "legal" uses. It clearly does apply to what your employer knows about you! Normally I hate these kind of hair-splitting "gotcha" cases I write up below, so I feel weird typing them. But the economic value is so high and frankly some of the the use, and abuse, cases so clear, I wonder. It's still early days for GDPR so these questions are, at the moment, rhetorical. Here's an example: part (26) says, "The principles of data protection should apply to any information concerning an identified or identifiable natural person." But if I call a company the telephone receptionist will answer and I will know I can reach them by calling that number. If they have three I know I can reach the one I want to by calling repeatedly. Yet you don't want to prevent publication of company phone numbers (and what about suppressing them until the receptionist leaves -- that leaks personal info too). (the section is actually about pseudonymisation BTW). Likewise per your example of IP addresses (in 30) If a company uses NAT then the company's IP address does not identify any single person, though it could be presumed to identify a particular subset. (adding IP address to other info could ID one person, and that is covered in 30)

gumby 8y ago

Here is the actual text of GDPR (there are many sites, hosted at .eu domains, that claim to tell you what the legislation says, but why not read the published law? (I chose English as HN is an English-language site): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32... ) My read is that the text of the law doesn't apply to people acting on behalf of a corporation, in their corporate persona (but this is why I linked to the text itself and not someone else's interpretation. It's not that long). The law talks about identifying a person in their personal sphere (doesn't apply to being in your home; talks about ties to fundamental human rights, genetic and health info, etc) or things like credit approval, and many many many exceptions for "national security" an "legal" uses. It clearly does apply to what your employer knows about you! Normally I hate these kind of hair-splitting "gotcha" cases I write up below, so I feel weird typing them. But the economic value is so high and frankly some of the the use, and abuse, cases so clear, I wonder. It's still early days for GDPR so these questions are, at the moment, rhetorical. Here's an example: part (26) says, "The principles of data protection should apply to any information concerning an identified or identifiable natural person." But if I call a company the telephone receptionist will answer and I will know I can reach them by calling that number. If they have three I know I can reach the one I want to by calling repeatedly. Yet you don't want to prevent publication of company phone numbers (and what about suppressing them until the receptionist leaves -- that leaks personal info too). (the section is actually about pseudonymisation BTW). Likewise per your example of IP addresses (in 30) If a company uses NAT then the company's IP address does not identify any single person, though it could be presumed to identify a particular subset. (adding IP address to other info could ID one person, and that is covered in 30)