3 ms·
Would that also mean that encrypted (not hashed) PII is also personal information? It should not be retrievable (in theory and practice) without the key.
by Gunax 6y ago
Would that also mean that encrypted (not hashed) PII is also personal information? It should not be retrievable (in theory and practice) without the key.
- number6 6y agoI have it from different DPAs that encrypted data are not PPI under the GDRP. The case might be different for passwords but you have to think around the corner a bit: You compare two hashes when you compare a password - you don't compare the password itself (the actual string in the form) - so what Identifies you as the person to the computer is not your password but the hash. So the hash itself is PII. Why isn't this true for encryption? Well good encryption in principle should not look different from random data. Will the same file encrypted with the same key produce the same outcome? Well - no. At least it shouldn't. So its not possible to identify someone with it like with a hash value. I can only speculate about the rational but this is the only explanation that come to my mind.