5 ms·

My preferred privacy policy is as follows: "Privacy Policy: We will not share your private information with anyone."

lmkg 7y ago
Not GDPR-compliant, nor would I personally consider it anywhere near complete. What information do you have about me? Can I see a copy of it? Why do you have it? What are you using it for? How long are you keeping it? How are you keeping it secure? (As far as I can tell, GDPR does not actually require you to answer how, only that you do it.) As an alternative, my preferred privacy policy: "We do not collect your personal information."
- akersten 7y ago
  Hey, yours isn't complete either! :) Just by visiting your site, you are collecting my personal information (after all, GDPR says IP address is PII). So what are you doing with it, and how long are you keeping it?
  - lmkg 7y ago
    GDPR does not say that IP address is PII. Among other objections, GDPR does not mention IP address, nor does it mention PII. The current guidance on IP addresses is ambiguous, but my understanding is that an IP address on its own does not count as personal data. It can become personal data when it's used to create a profile. So if you only have the full IP fleetingly to serve web pages, and all logging wipes the last octet, there's no point where the data that you process counts as personal data.
    - droithomme 7y ago
      GDPR doesn't get that specific, but the judges in the courts do. In Breyer v. Bundesrepublik Deutschland, E.C.J., No. C-582/14, 10/19/16, it was ruled that internet protocol addresses relating to visitors' use of websites constitutes "protected data" according to European Union laws.
      - lmkg 7y ago
        Thank you for the case citation. This is the summary I found: https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-10/cp160112en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201... My reading of that, and online commentary that I've found, seem to indicate that the IP address is not personal data across the board, but rather only in a specific context. I'm a little over my head in whether that specific context is "basically all the time" or not. It sounds like it only applies when you have the legal right to make the ISP give you subscriber info related to an IP address?
        guitarbill 7y ago
        From that document and other reading, I think it's also when combination of information results in being able to identify a person. For example, dynamic IP address + timestamp is not enough for anybody but the ISP. But add in other information, for example HTTP headers, it might be unique enough. Also, what they're saying is some things trump privacy. Legal requirements to keep logs. Legitimate interest, e.g. billing. Defending against cyber attacks. Using that information for other purposes is still a no-no. TL;DR: IP address + other info often becomes PII, and there are some exceptional cases where it's legitimate to store PII despite privacy concerns.
akersten 7y ago
Yes, but what does that mean? What does your site define as private information? If the data got sent to you, it's no longer "private," at least in one sense of the word. Is "selling" information considering "sharing"? Questions like these are why the legalese of privacy policies needs to be complicated - it's simply ambiguous otherwise.
- thekyle 7y ago
  Also, most sites are hosted by hosting companies. Is putting PII in a database on a server in a datacenter not owned by the site owner sharing?
- droithomme 7y ago
  > Yes, but what does that mean? It means exactly what people would expect it to mean. In such cases of plain and simple language in a contract, courts go with that. > What does your site define as private information? If a site defines what is private information that is different from a common sense understanding, the site is being dishonest and tricky. > If the data got sent to you, it's no longer "private," at least in one sense of the word. That is an absurd and disingenuous interpretation that no reasonable person would ever expect to mean to be the definition of private. > Is "selling" information considering "sharing"? Yes, selling information is sharing it. Obviously. As any court would rule. > Questions like these are why the legalese of privacy policies needs to be complicated - it's simply ambiguous otherwise. Complicated contracts are always bullshit 10,000% of the time, designed to cheat and trick in all of the cases, without any exception ever. The most simple language possible is needed. Complex wording hides a multitude of sins.
LinuxBender 7y ago
I tried to convey something similar and simple [1] I think [1] - https://tinyvpn.org/help/#privacy https://tinyvpn.org/help/#privacy

lmkg 7y ago

Not GDPR-compliant, nor would I personally consider it anywhere near complete. What information do you have about me? Can I see a copy of it? Why do you have it? What are you using it for? How long are you keeping it? How are you keeping it secure? (As far as I can tell, GDPR does not actually require you to answer how, only that you do it.) As an alternative, my preferred privacy policy: "We do not collect your personal information."

akersten 7y ago
Hey, yours isn't complete either! :) Just by visiting your site, you are collecting my personal information (after all, GDPR says IP address is PII). So what are you doing with it, and how long are you keeping it?
- lmkg 7y ago
  GDPR does not say that IP address is PII. Among other objections, GDPR does not mention IP address, nor does it mention PII. The current guidance on IP addresses is ambiguous, but my understanding is that an IP address on its own does not count as personal data. It can become personal data when it's used to create a profile. So if you only have the full IP fleetingly to serve web pages, and all logging wipes the last octet, there's no point where the data that you process counts as personal data.
  - droithomme 7y ago
    GDPR doesn't get that specific, but the judges in the courts do. In Breyer v. Bundesrepublik Deutschland, E.C.J., No. C-582/14, 10/19/16, it was ruled that internet protocol addresses relating to visitors' use of websites constitutes "protected data" according to European Union laws.
    - lmkg 7y ago
      Thank you for the case citation. This is the summary I found: https://curia.europa.eu/jcms/upload/docs/application/pdf/2016-10/cp160112en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201... My reading of that, and online commentary that I've found, seem to indicate that the IP address is not personal data across the board, but rather only in a specific context. I'm a little over my head in whether that specific context is "basically all the time" or not. It sounds like it only applies when you have the legal right to make the ISP give you subscriber info related to an IP address?
      - guitarbill 7y ago
        From that document and other reading, I think it's also when combination of information results in being able to identify a person. For example, dynamic IP address + timestamp is not enough for anybody but the ISP. But add in other information, for example HTTP headers, it might be unique enough. Also, what they're saying is some things trump privacy. Legal requirements to keep logs. Legitimate interest, e.g. billing. Defending against cyber attacks. Using that information for other purposes is still a no-no. TL;DR: IP address + other info often becomes PII, and there are some exceptional cases where it's legitimate to store PII despite privacy concerns.

akersten 7y ago

Yes, but what does that mean? What does your site define as private information? If the data got sent to you, it's no longer "private," at least in one sense of the word. Is "selling" information considering "sharing"? Questions like these are why the legalese of privacy policies needs to be complicated - it's simply ambiguous otherwise.

thekyle 7y ago
Also, most sites are hosted by hosting companies. Is putting PII in a database on a server in a datacenter not owned by the site owner sharing?
droithomme 7y ago
> Yes, but what does that mean? It means exactly what people would expect it to mean. In such cases of plain and simple language in a contract, courts go with that. > What does your site define as private information? If a site defines what is private information that is different from a common sense understanding, the site is being dishonest and tricky. > If the data got sent to you, it's no longer "private," at least in one sense of the word. That is an absurd and disingenuous interpretation that no reasonable person would ever expect to mean to be the definition of private. > Is "selling" information considering "sharing"? Yes, selling information is sharing it. Obviously. As any court would rule. > Questions like these are why the legalese of privacy policies needs to be complicated - it's simply ambiguous otherwise. Complicated contracts are always bullshit 10,000% of the time, designed to cheat and trick in all of the cases, without any exception ever. The most simple language possible is needed. Complex wording hides a multitude of sins.

LinuxBender 7y ago

I tried to convey something similar and simple [1] I think [1] - https://tinyvpn.org/help/#privacy https://tinyvpn.org/help/#privacy