4 ms·

They say the data is GDPR compliant. If the data is anonymous (and the linked page specifically says "completely anonymized"), the GDPR does not apply, as far a

by eddyg 7y ago

They say the data is GDPR compliant. If the data is anonymous (and the linked page specifically says "completely anonymized"), the GDPR does not apply, as far as I know. See Recital 26. [0] > This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. Crash data does not mean it contains memory dumps; it could just be assertions and stack traces. [0] https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/

tinus_hn 7y ago
The data includes the users IP address which is personal information. It is not anonymous.
- eddyg 7y ago
  Where does it say the IP address is stored with the data? Recital 26 says: > The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not OR NO LONGER identifiable. [emphasis mine] So as long as the data becomes no longer identifiable, recital 26 seems to apply.
  - simpss 7y ago
    in their privacy policy. Section 1b. The Usage Data that we collect may include information such as ...... Internet Protocol address ...... https://www.ui.com/legal/privacypolicy/ https://www.ui.com/legal/privacypolicy/
    - eddyg 7y ago
      Fair enough. It does say "may". :) It's still possible for other data to be "anonymous" if it's stored independently of an IP address, device identifier, etc. since recital 26 allows for data that is "no longer identifiable".
      - netik 7y ago
        The moment the device connects to Unifi, without your permission, they have your IP. Then again, they had it when you downloaded the update, and when your devices check for auto update, so, you’re not getting away from this data collection with an opt out button.
      - organsnyder 7y ago
        "May" is synonymous with "will", as far as complying with privacy regulations is concerned.
      - simpss 7y ago
        in such case, it might be pseudonymous, but to make it pseudonymous specific effort is required. I'll copy an old comment which explains the terms. ID in this case could be the IP address, device identifier etc... -------------------------- A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII. the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2]. So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them. [1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable https://www.lexico.com/en/definition/identifiable [2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.
esotericn 7y ago
I didn't mention anything about GDPR. I don't want any data to be sent to Ubiquiti. This forces me to now treat my network hardware as an untrusted device.

by eddyg 7y ago

tinus_hn 7y ago

The data includes the users IP address which is personal information. It is not anonymous.

eddyg 7y ago
Where does it say the IP address is stored with the data? Recital 26 says: > The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not OR NO LONGER identifiable. [emphasis mine] So as long as the data becomes no longer identifiable, recital 26 seems to apply.
- simpss 7y ago
  in their privacy policy. Section 1b. The Usage Data that we collect may include information such as ...... Internet Protocol address ...... https://www.ui.com/legal/privacypolicy/ https://www.ui.com/legal/privacypolicy/
  - eddyg 7y ago
    Fair enough. It does say "may". :) It's still possible for other data to be "anonymous" if it's stored independently of an IP address, device identifier, etc. since recital 26 allows for data that is "no longer identifiable".
    - netik 7y ago
      The moment the device connects to Unifi, without your permission, they have your IP. Then again, they had it when you downloaded the update, and when your devices check for auto update, so, you’re not getting away from this data collection with an opt out button.
    - organsnyder 7y ago
      "May" is synonymous with "will", as far as complying with privacy regulations is concerned.
    - simpss 7y ago
      in such case, it might be pseudonymous, but to make it pseudonymous specific effort is required. I'll copy an old comment which explains the terms. ID in this case could be the IP address, device identifier etc... -------------------------- A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII. the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2]. So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them. [1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable https://www.lexico.com/en/definition/identifiable [2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.

esotericn 7y ago

I didn't mention anything about GDPR. I don't want any data to be sent to Ubiquiti. This forces me to now treat my network hardware as an untrusted device.