4 ms·

As long as events don't have name/email/ip/... there should be no problem as far as i understand it. The regulation targets only personal identifiable informati

by dorgo 8y ago

As long as events don't have name/email/ip/... there should be no problem as far as i understand it. The regulation targets only personal identifiable information.

icebraining 8y ago
PII is a concept is US law. The GDPR uses personal data, defined as: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person" Pseudonymization (separating unique identifiers from the rest of the datapoints) can and should be used as a safeguard, but doesn't remove the need to protect the data, particularly if you keep a link between the two.
chrisseaton 8y ago
If you were a bookshop and your events log someone anonymous as buying a book on niche topics A, B and C, I reckon that could easily globally uniquely identify me as there aren't many people in the world interested in all three. Then you could also see me buying a book on embarrassing topic D and blackmail me with it. No personal identifying information, but it's not anonymous.
- mywittyname 8y ago
  Finger-printing is not PII. And the people blackmailing you because you're interested in both finger painting and the orficial applications of pine cones would not be entirely sure it was you. If they had an email address, name, or IP address with a timestamp, then they could be quite certain it that it was you.
  - deleted 8y ago
    [deleted]
  - chrisseaton 8y ago
    > Finger-printing is not PII I didn’t say it was. The original conversation wasn’t about PII it was about anonymising. Fingerprints defeat anonymisation. I reckon in practice with for example an Amazon sales log with names removed and my public Twitter feed you could de-anonymise me with a high degree of certainty.

by dorgo 8y ago

As long as events don't have name/email/ip/... there should be no problem as far as i understand it. The regulation targets only personal identifiable information.

icebraining 8y ago

PII is a concept is US law. The GDPR uses personal data, defined as: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person" Pseudonymization (separating unique identifiers from the rest of the datapoints) can and should be used as a safeguard, but doesn't remove the need to protect the data, particularly if you keep a link between the two.

chrisseaton 8y ago

If you were a bookshop and your events log someone anonymous as buying a book on niche topics A, B and C, I reckon that could easily globally uniquely identify me as there aren't many people in the world interested in all three. Then you could also see me buying a book on embarrassing topic D and blackmail me with it. No personal identifying information, but it's not anonymous.

mywittyname 8y ago
Finger-printing is not PII. And the people blackmailing you because you're interested in both finger painting and the orficial applications of pine cones would not be entirely sure it was you. If they had an email address, name, or IP address with a timestamp, then they could be quite certain it that it was you.
- deleted 8y ago
  [deleted]
- chrisseaton 8y ago
  > Finger-printing is not PII I didn’t say it was. The original conversation wasn’t about PII it was about anonymising. Fingerprints defeat anonymisation. I reckon in practice with for example an Amazon sales log with names removed and my public Twitter feed you could de-anonymise me with a high degree of certainty.