3 ms·

I'm pretty sure GDPR is meant to force disclosure of derived data too.

mehrdadn 8y ago
Are you sure? I didn't find a clear sentence on this last time I looked. It seems hard to define what is derived data (if they guess that a 20 year old is a student, is that derived data? or just a guess) and I can imagine it leaking information about other people if it involved aggregating together pieces of data from multiple people.
- icebraining 8y ago
  The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person". So as long as this derived data is directly related to a person, the GDPR applies. More explicitly, the UK's regulator says: "You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request."
  - mehrdadn 8y ago
    Huh, thanks for that. So e.g. LinkedIn not providing any information on (say) emails they've scraped seems blatantly illegal too?
jenscow 8y ago
In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.
- jsty 8y ago
  Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'
  - isostatic 8y ago
    What if you don't store the inference, but instead process it when needed internally in a function? if (dob.month == december) $birthstone = quartz select advert from adverts where stone = $birthstone Or whatever
    - tyfon 8y ago
      GDPR requires that you log when you use information from a user in models, reports etc so this would probably have to be logged and disclosed. You would also need explicit concent to use the date of birth for advertising purposes.
    - icebraining 8y ago
      For ads, you probably don't need to tell people about the "birthstone". But if that automatic processing "produces legal effects concerning him or her or similarly significantly affects him or her" (such as denying a credit card or job offer), then you have to give the person "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for [them]."

Are you sure? I didn't find a clear sentence on this last time I looked. It seems hard to define what is derived data (if they guess that a 20 year old is a student, is that derived data? or just a guess) and I can imagine it leaking information about other people if it involved aggregating together pieces of data from multiple people.

icebraining 8y ago
The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person". So as long as this derived data is directly related to a person, the GDPR applies. More explicitly, the UK's regulator says: "You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request."
- mehrdadn 8y ago
  Huh, thanks for that. So e.g. LinkedIn not providing any information on (say) emails they've scraped seems blatantly illegal too?

jenscow 8y ago

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

jsty 8y ago
Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'
- isostatic 8y ago
  What if you don't store the inference, but instead process it when needed internally in a function? if (dob.month == december) $birthstone = quartz select advert from adverts where stone = $birthstone Or whatever
  - tyfon 8y ago
    GDPR requires that you log when you use information from a user in models, reports etc so this would probably have to be logged and disclosed. You would also need explicit concent to use the date of birth for advertising purposes.
  - icebraining 8y ago
    For ads, you probably don't need to tell people about the "birthstone". But if that automatic processing "produces legal effects concerning him or her or similarly significantly affects him or her" (such as denying a credit card or job offer), then you have to give the person "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for [them]."