5 ms·

I just looked up the relevant section in the GDPR, and it's actually pretty clear: It's section 9 "Processing of special categories of personal data" https://

by yarcob 6y ago

I just looked up the relevant section in the GDPR, and it's actually pretty clear: It's section 9 "Processing of special categories of personal data" https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/ > 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited > 2. Paragraph 1 shall not apply if one of the following applies: > (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; > (...)

Blikkentrekker 6y ago
So any data that does not fall under that blacklist is free game? I still find that quite arbitrary to make that distinction, not to mention the wiggle room it leaves with many of those categories being rather ill-defined. At what point does an opinion become “political”? what is “racial” an “ethnic origin” is quite open to interpretation; when is a belief “philosophical”? The way I understand this paragraph, it could conceivably be so that an opinion that, say, consoles are not suited for f.p.s. games could freely be processed, but an opinion that U.K. roads are unsuitable for cycling could not, as the latter would be more easily classified as “political” even though the former could too, and the later could conceivably not as well? I find that very arbitrary.
- anticristi 6y ago
  "Jein" (German for "yno"). Look at it in historic context. This article can be seen as an anti-holocaust clause. Don't collect data that was too often used to harm minorities.
  - Blikkentrekker 6y ago
    Yet many data that aren't listed under it can also be used to harm minorities, and many data that are, can not. How exactly does biometric data to identify a person, but not a name and address to do the same differ in how much it can be used to harm minorities? They are both a means to uniquely triangulate the identity of a person, one is arbitrarily allowed but the other is not. It's as arbitrary as if not permitting murder with poisons, but permit it so long as it be done with a knife.
    - anticristi 6y ago
      A database of names and addresses does not tell you who in that list is a minority. You can't do: SELECT address AS to_harm WHERE sexual_orientation IN ('unusual');
      - Blikkentrekker 6y ago
        Neither does biometric data? How can I tell minority status from a fingerprint or retinal scan? It seems rather arbitrary to treat name and address differently from fingerprints. I would argue that minority status correlates more heavily with name than with retinal patterns.
        anticristi 6y ago
        I'm guessing that biometric data is sensitive, since it cannot be changed. You can change your name and address, but your biometric data will follow you for the rest of your life.
- yarcob 6y ago
  > So any data that does not fall under that blacklist is free game? No. That list are data that are considered especially sensitive, and so it's generally prohibited to process personal data of this kind. As far as I can tell it's the strictest part of the GDPR, so it's probably also the easiest to enforce. If some data doesn't fall into these "special categories", the rest of the GDPR still applies. The GDPR applies to any data linked to natural persons.
  - Blikkentrekker 6y ago
    Yes, so we arrive at “if I understand this correctly, it is not a problem, or a lesser or different problem” as I first asked. I find this distinction to be bereft of a proper justification. As I said elsewhere, I cannot think of any salient reason to not cover name and address as a means to identify a person, but do cover far more obscure and unlikely biometric data. It should not be protected in any different way.
    - yarcob 6y ago
      This is getting a bit off-topic, but there are good reasons why biometric data is especially sensitive. For example, the GDPR emphasizes the "right to be forgotten". If something bad happened to you, you may not want to be forever defined by that event. A kidnapped person might not want to be forever known as just a crime victim. So they can ask Google to remove mentions of their name, and they can even legally change their name as a last resort. But if eg. Facebook stored their face measurements and then automatically tagged them in a newly uploaded photo all that would be pointless. So it makes sense to treat certain data as more sensitive. At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?"). Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data. I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much.

by yarcob 6y ago

Blikkentrekker 6y ago

So any data that does not fall under that blacklist is free game? I still find that quite arbitrary to make that distinction, not to mention the wiggle room it leaves with many of those categories being rather ill-defined. At what point does an opinion become “political”? what is “racial” an “ethnic origin” is quite open to interpretation; when is a belief “philosophical”? The way I understand this paragraph, it could conceivably be so that an opinion that, say, consoles are not suited for f.p.s. games could freely be processed, but an opinion that U.K. roads are unsuitable for cycling could not, as the latter would be more easily classified as “political” even though the former could too, and the later could conceivably not as well? I find that very arbitrary.

anticristi 6y ago
"Jein" (German for "yno"). Look at it in historic context. This article can be seen as an anti-holocaust clause. Don't collect data that was too often used to harm minorities.
- Blikkentrekker 6y ago
  Yet many data that aren't listed under it can also be used to harm minorities, and many data that are, can not. How exactly does biometric data to identify a person, but not a name and address to do the same differ in how much it can be used to harm minorities? They are both a means to uniquely triangulate the identity of a person, one is arbitrarily allowed but the other is not. It's as arbitrary as if not permitting murder with poisons, but permit it so long as it be done with a knife.
  - anticristi 6y ago
    A database of names and addresses does not tell you who in that list is a minority. You can't do: SELECT address AS to_harm WHERE sexual_orientation IN ('unusual');
    - Blikkentrekker 6y ago
      Neither does biometric data? How can I tell minority status from a fingerprint or retinal scan? It seems rather arbitrary to treat name and address differently from fingerprints. I would argue that minority status correlates more heavily with name than with retinal patterns.
      - anticristi 6y ago
        I'm guessing that biometric data is sensitive, since it cannot be changed. You can change your name and address, but your biometric data will follow you for the rest of your life.
yarcob 6y ago
> So any data that does not fall under that blacklist is free game? No. That list are data that are considered especially sensitive, and so it's generally prohibited to process personal data of this kind. As far as I can tell it's the strictest part of the GDPR, so it's probably also the easiest to enforce. If some data doesn't fall into these "special categories", the rest of the GDPR still applies. The GDPR applies to any data linked to natural persons.
- Blikkentrekker 6y ago
  Yes, so we arrive at “if I understand this correctly, it is not a problem, or a lesser or different problem” as I first asked. I find this distinction to be bereft of a proper justification. As I said elsewhere, I cannot think of any salient reason to not cover name and address as a means to identify a person, but do cover far more obscure and unlikely biometric data. It should not be protected in any different way.
  - yarcob 6y ago
    This is getting a bit off-topic, but there are good reasons why biometric data is especially sensitive. For example, the GDPR emphasizes the "right to be forgotten". If something bad happened to you, you may not want to be forever defined by that event. A kidnapped person might not want to be forever known as just a crime victim. So they can ask Google to remove mentions of their name, and they can even legally change their name as a last resort. But if eg. Facebook stored their face measurements and then automatically tagged them in a newly uploaded photo all that would be pointless. So it makes sense to treat certain data as more sensitive. At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?"). Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data. I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much.