3 ms·
I think we need to change the definition of "personal data" in GDPR from things like name, phone number etc. to just bits. It takes around 33 bits to identify a
by tomp 6y ago
I think we need to change the definition of "personal data" in GDPR from things like name, phone number etc. to just bits. It takes around 33 bits to identify a person, with some leeway (so maybe like 26 bits).
Sex == 1 bit. Hair color =~ 2 bits. Glasses/no glasses =~ 0.6 bits. Phone number == 33 bits. Location to 1km precision would be many more bits in a rural area (less people / lower density) than in a big city. And so on.
This would take care of the metadata. It would also put the companies on the defensive - if _the company_ thinks they're collecting just 20bits of data, but if I can do some fancy ML on their data (require regular external audits of collected data if more than say 10k people were tracked) and retrieve 27bits, that would put them in breach (& massive penalties).
- hyperman1 6y agoThey more or less already do: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Chapter 1 Article 4, definition of personal data [...] an identifiable natural person is one who can be identified, directly or indirectly [...] or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; If I read this correct, if you can be identified by a tuple (sex,hair color, classes, more attributes), the GDPR applies, even if they have no name etc... Hence, even an anonymized ID is still identification for the GDPR.