4 ms·

> So any data that does not fall under that blacklist is free game? No. That list are data that are considered especially sensitive, and so it's generally proh

by yarcob 6y ago

> So any data that does not fall under that blacklist is free game? No. That list are data that are considered especially sensitive, and so it's generally prohibited to process personal data of this kind. As far as I can tell it's the strictest part of the GDPR, so it's probably also the easiest to enforce. If some data doesn't fall into these "special categories", the rest of the GDPR still applies. The GDPR applies to any data linked to natural persons.

Blikkentrekker 6y ago
Yes, so we arrive at “if I understand this correctly, it is not a problem, or a lesser or different problem” as I first asked. I find this distinction to be bereft of a proper justification. As I said elsewhere, I cannot think of any salient reason to not cover name and address as a means to identify a person, but do cover far more obscure and unlikely biometric data. It should not be protected in any different way.
- yarcob 6y ago
  This is getting a bit off-topic, but there are good reasons why biometric data is especially sensitive. For example, the GDPR emphasizes the "right to be forgotten". If something bad happened to you, you may not want to be forever defined by that event. A kidnapped person might not want to be forever known as just a crime victim. So they can ask Google to remove mentions of their name, and they can even legally change their name as a last resort. But if eg. Facebook stored their face measurements and then automatically tagged them in a newly uploaded photo all that would be pointless. So it makes sense to treat certain data as more sensitive. At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?"). Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data. I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much.
  - Blikkentrekker 6y ago
    > So it makes sense to treat certain data as more sensitive. I cannot change my name so easily as far as the Dutch government is concerned as well as that of many other European countries. I need a reason of significance and a simple “I wish to be forgotten and start a new life.” is not accepted, as it is in many European countries. If the E.U. cared so much about this, it would mandate that it's member states permit easier name changes. Simply put, it is easier for me in the Netherlands to have plastic surgery and change my biometric data, than it is for me to change my name so I am holly unconvinced by this argument and it seems ad-hoc to justify what is purely an irrational distinction. > At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?"). There are already exceptions in place in the law where data may be collected if it be essential for operations. As it stands, companies may ask for my name and address when they have no need for it to process anything, this information can surely be used to uniquely triangulate my identity with little effort, far more effort would be required to do so with a picture of my face, or a scan of my retina. This seems highly arbitrary and ineffective to me. I remain very much unconvinced that this distinction is one that was given any serious thought. > Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data. It is far, far more sensitive. Would you rather that your name and address be placed on H.N., or that your fingerprints or retinal pattern end up here? Would you rather a stalker have the former or the latter? To triangulate a man's identity from biometric data requires specialized equipment, to do so from name and address is a trivial endeavor a layman can undertake. > I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much. I do not. I find the distinction made here to be completely arbitrary and undeniable that name and address are far more sensitive and open to abuse than biometric data, the latter requiring specialized equipment to make use of. Again, would you rather a stalker have your name and address, or your retinal scan?
  - 6y ago

by yarcob 6y ago

Blikkentrekker 6y ago

Yes, so we arrive at “if I understand this correctly, it is not a problem, or a lesser or different problem” as I first asked. I find this distinction to be bereft of a proper justification. As I said elsewhere, I cannot think of any salient reason to not cover name and address as a means to identify a person, but do cover far more obscure and unlikely biometric data. It should not be protected in any different way.

yarcob 6y ago
This is getting a bit off-topic, but there are good reasons why biometric data is especially sensitive. For example, the GDPR emphasizes the "right to be forgotten". If something bad happened to you, you may not want to be forever defined by that event. A kidnapped person might not want to be forever known as just a crime victim. So they can ask Google to remove mentions of their name, and they can even legally change their name as a last resort. But if eg. Facebook stored their face measurements and then automatically tagged them in a newly uploaded photo all that would be pointless. So it makes sense to treat certain data as more sensitive. At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?"). Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data. I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much.
- Blikkentrekker 6y ago
  > So it makes sense to treat certain data as more sensitive. I cannot change my name so easily as far as the Dutch government is concerned as well as that of many other European countries. I need a reason of significance and a simple “I wish to be forgotten and start a new life.” is not accepted, as it is in many European countries. If the E.U. cared so much about this, it would mandate that it's member states permit easier name changes. Simply put, it is easier for me in the Netherlands to have plastic surgery and change my biometric data, than it is for me to change my name so I am holly unconvinced by this argument and it seems ad-hoc to justify what is purely an irrational distinction. > At the same time, the GDPR doesn't want to go overboard with regulation. Name and address are data that lots of businesses need to process -- eg. every online store needs to collect customer name and address and pass it on to payment providers, shipping companies, etc. It would be really inconvenient if you'd need explicit permission for each use ("Do you consent that I can tell the post office where to deliver your package?"). There are already exceptions in place in the law where data may be collected if it be essential for operations. As it stands, companies may ask for my name and address when they have no need for it to process anything, this information can surely be used to uniquely triangulate my identity with little effort, far more effort would be required to do so with a picture of my face, or a scan of my retina. This seems highly arbitrary and ineffective to me. I remain very much unconvinced that this distinction is one that was given any serious thought. > Sure, someone may find a way to abuse a list of names and addresses, but it's just not as sensitive as other data. It is far, far more sensitive. Would you rather that your name and address be placed on H.N., or that your fingerprints or retinal pattern end up here? Would you rather a stalker have the former or the latter? To triangulate a man's identity from biometric data requires specialized equipment, to do so from name and address is a trivial endeavor a layman can undertake. > I think the GDPR actually strikes a great balance between protecting people's privacy and not inconveniencing businesses. If you only collect and process data that's absolutely necessary for providing your service, the GDPR won't inconvenience you much. I do not. I find the distinction made here to be completely arbitrary and undeniable that name and address are far more sensitive and open to abuse than biometric data, the latter requiring specialized equipment to make use of. Again, would you rather a stalker have your name and address, or your retinal scan?
- 6y ago