5 ms·

GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.) "

by lbotos 5y ago

GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.) "The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis." - https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/

bserge 5y ago
An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?
- gjs278 5y ago
  it definitely is someone
- owlmirror 5y ago
  PII can be anything unique tied to a person. email addresses are definitely PII. even if you have not the full name of a person in the address, such an address usually is unique to a single person and as such one of the best identifiers you will usually have.
- usr1106 5y ago
  IANAL, but IIRC PII/PID is a US concept. The GDPR does not talk about such thing at all. Back when GDPR was new there quite some discussion about the differences. Don't remember the details. Maybe someone can remind us.
  - deleted 5y ago
    [deleted]
- BeniBoy 5y ago
  As a sibling comment said, the notion is "Personal Data". It is very wide and email address definitely fall within it. Also note IP is personal data, and an identifier like a UUID of the IDFA is personal data. The key point is that it must be related to an identified *or identifiable* data subject, ie even if that information is not enough to identify the person, the fact that it can contribute to it makes it personal data.
- dafoex 5y ago
  With that information I can: • Say with a lot of confidence that billy69420@cbt.eu is owned by one person, called William. • Infer that, since the e-mail says Billy, but the name says William, the latter is probably what appears on any official documentation. • Infer that any services signed up to using billy69420@cbt.eu as the e-mail address are more than likely tied to this William person - including any services I run or otherwise have administrative access to. • Search for billy69420@cbt.eu on various public information repositories and reverse email searches. • Add an entry to a database using billy69420@cbt.eu as a primary key (e-mail addresses are necessarily unique) to enable me to keep track of my current and future information and inferences, thus building a profile on the person. I can also understand that the sex and weed references mean that you've probably not given a real e-mail in this example, but if it were real I might be able to infer an age range (or at least a level of maturity) of the user from that, although this would be unreliable as the user could have made the e-mail account some time ago and just still happen to be using it.
  - bserge 5y ago
    From OPs link to the official guidelines: "If data are inaccurate to the point that no individual can be identified, then the information is not personal data. (e.g. If you refer to “the man who lives at 12 Mulberry Lane had a party last night,” when Mulberry Lane ends at number 10, that’s not personal data.). I could guess "12" was a mistake and just send spam or visit the man living at number 10. That's way more dangerous imo than an old skool email address and a first name. Yet it's apparently not considered personal data. That's why I asked, actually, since it confused me.
  - currency 5y ago
    Plenty of addresses are designed to mislead. Twitter bots, especially. You can't actually assume good faith on the part of the owner of the address.
    - TeMPOraL 5y ago
      You can at scale. Separating bots from real people is a somewhat orthogonal concern, and given a large dataset containing mostly real people, you can safely assume vast majority of the data is not purposefully misleading. Vast majority is good enough for advertising, and mistakes in non-advertising use usually create a problem for the e-mail owner, not the database user.
- rlpb 5y ago
  The test is whether that information can later be used to link to an individual. You might not have the information, but you might later be able to correlate it against someone who does, and that makes it personally identifiable and under the scope of the GDPR. Here's a citation: "If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
rkagerer 5y ago
Article 50 is not very specific. For enforcement to have teeth outside their jurisdiction don't they either need assets or revenue streams in the EU which can be confiscated/leveraged, or else good old fashioned extradition treaties? And don't the latter typically require said crime to be illegal in both jurisdictions?
- rkagerer 5y ago
  Here are some musings on the subject from https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-outside-of-the-eu/ https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-... "In theory it could be that the EDPB could place embargoes, on sales of Acme Cola’s products within Europe, but if Acme Cola has a strong voice in the Senate, or indeed in Washington, would the US authorities play ball and encourage them to pay the fines, or would they be lobbied and fall on the side of Acme Cola to say no, we do not accept that US companies should have to adhere to someone else’s law?" And here's a potential test case unfolding: https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-website-without-an-eu-representative-signal-a-change-in-gdpr-enforcement-priorities/ https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-...
  - BeFlatXIII 5y ago
    Senators may agree with Acme Cola even without lobbying simply to flex national sovereignty (especially if they have a large America First demographic in their state and it's re-election year). "Your law = your enforcement problem"
- remus 5y ago
  I don't think the theory is really so complicated. If you want to provide products or services within a country then you need to abide by the laws of that country, if you don't then the legal system of that country has various measures to make doing business in that country prohibitive. At a basic level you could imagine court ordered DNS blocking by ISPs (as is done for the pirate bay in many places), or if you were really naughty then extradition, arrests of key individuals in your org if they try and travel etc.
orangeoxidation 5y ago
> What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber).
- remus 5y ago
  > In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. > Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber). I think this is a fairly cynical take. I think data privacy as a whole is greatly improved since the introduction of GDPR, and difficult questions are being asked of companies doing dodgy things with personal data (e.g. google, facebook). I have some sympathy for the enforcement authorities who are relatively small organisations trying to enforce large changes across a huge swath of companies. They need to pick their battles, and going after lots of little fish is probably not a great strategy.
  - di4na 5y ago
    Keep in mind too that a lot of company registered to the Irish DPC which is quite... lax. And the rest of the EU enforcement agency and the ECJ are both in a constant fight to close that loophole. Which they are slowly winning. Ramping up regulations take time, but they work on tax schedule. They will win in the end.
  - OneTimePetes 5y ago
    It should have been standardized, so it can be auto-negotiated. Not these dark patern menues, but a popup screen: This site overreaches regarding privacy, in addition what you are usually willing to give - it demands: - List Are you willing to give in to the demands: - Just once - Fake my data - Always - Never This could and should have been all you see of GDPR. Maybee technical laws should also enforce a standard for consent interfaces.

by lbotos 5y ago

bserge 5y ago

An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?

gjs278 5y ago
it definitely is someone
owlmirror 5y ago
PII can be anything unique tied to a person. email addresses are definitely PII. even if you have not the full name of a person in the address, such an address usually is unique to a single person and as such one of the best identifiers you will usually have.
usr1106 5y ago
IANAL, but IIRC PII/PID is a US concept. The GDPR does not talk about such thing at all. Back when GDPR was new there quite some discussion about the differences. Don't remember the details. Maybe someone can remind us.
- deleted 5y ago
  [deleted]
BeniBoy 5y ago
As a sibling comment said, the notion is "Personal Data". It is very wide and email address definitely fall within it. Also note IP is personal data, and an identifier like a UUID of the IDFA is personal data. The key point is that it must be related to an identified *or identifiable* data subject, ie even if that information is not enough to identify the person, the fact that it can contribute to it makes it personal data.
dafoex 5y ago
With that information I can: • Say with a lot of confidence that billy69420@cbt.eu is owned by one person, called William. • Infer that, since the e-mail says Billy, but the name says William, the latter is probably what appears on any official documentation. • Infer that any services signed up to using billy69420@cbt.eu as the e-mail address are more than likely tied to this William person - including any services I run or otherwise have administrative access to. • Search for billy69420@cbt.eu on various public information repositories and reverse email searches. • Add an entry to a database using billy69420@cbt.eu as a primary key (e-mail addresses are necessarily unique) to enable me to keep track of my current and future information and inferences, thus building a profile on the person. I can also understand that the sex and weed references mean that you've probably not given a real e-mail in this example, but if it were real I might be able to infer an age range (or at least a level of maturity) of the user from that, although this would be unreliable as the user could have made the e-mail account some time ago and just still happen to be using it.
- bserge 5y ago
  From OPs link to the official guidelines: "If data are inaccurate to the point that no individual can be identified, then the information is not personal data. (e.g. If you refer to “the man who lives at 12 Mulberry Lane had a party last night,” when Mulberry Lane ends at number 10, that’s not personal data.). I could guess "12" was a mistake and just send spam or visit the man living at number 10. That's way more dangerous imo than an old skool email address and a first name. Yet it's apparently not considered personal data. That's why I asked, actually, since it confused me.
- currency 5y ago
  Plenty of addresses are designed to mislead. Twitter bots, especially. You can't actually assume good faith on the part of the owner of the address.
  - TeMPOraL 5y ago
    You can at scale. Separating bots from real people is a somewhat orthogonal concern, and given a large dataset containing mostly real people, you can safely assume vast majority of the data is not purposefully misleading. Vast majority is good enough for advertising, and mistakes in non-advertising use usually create a problem for the e-mail owner, not the database user.
rlpb 5y ago
The test is whether that information can later be used to link to an individual. You might not have the information, but you might later be able to correlate it against someone who does, and that makes it personally identifiable and under the scope of the GDPR. Here's a citation: "If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

rkagerer 5y ago

Article 50 is not very specific. For enforcement to have teeth outside their jurisdiction don't they either need assets or revenue streams in the EU which can be confiscated/leveraged, or else good old fashioned extradition treaties? And don't the latter typically require said crime to be illegal in both jurisdictions?

rkagerer 5y ago
Here are some musings on the subject from https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-outside-of-the-eu/ https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-... "In theory it could be that the EDPB could place embargoes, on sales of Acme Cola’s products within Europe, but if Acme Cola has a strong voice in the Senate, or indeed in Washington, would the US authorities play ball and encourage them to pay the fines, or would they be lobbied and fall on the side of Acme Cola to say no, we do not accept that US companies should have to adhere to someone else’s law?" And here's a potential test case unfolding: https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-website-without-an-eu-representative-signal-a-change-in-gdpr-enforcement-priorities/ https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-...
- BeFlatXIII 5y ago
  Senators may agree with Acme Cola even without lobbying simply to flex national sovereignty (especially if they have a large America First demographic in their state and it's re-election year). "Your law = your enforcement problem"
remus 5y ago
I don't think the theory is really so complicated. If you want to provide products or services within a country then you need to abide by the laws of that country, if you don't then the legal system of that country has various measures to make doing business in that country prohibitive. At a basic level you could imagine court ordered DNS blocking by ISPs (as is done for the pirate bay in many places), or if you were really naughty then extradition, arrests of key individuals in your org if they try and travel etc.

orangeoxidation 5y ago

> What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber).

remus 5y ago
> In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. > Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber). I think this is a fairly cynical take. I think data privacy as a whole is greatly improved since the introduction of GDPR, and difficult questions are being asked of companies doing dodgy things with personal data (e.g. google, facebook). I have some sympathy for the enforcement authorities who are relatively small organisations trying to enforce large changes across a huge swath of companies. They need to pick their battles, and going after lots of little fish is probably not a great strategy.
- di4na 5y ago
  Keep in mind too that a lot of company registered to the Irish DPC which is quite... lax. And the rest of the EU enforcement agency and the ECJ are both in a constant fight to close that loophole. Which they are slowly winning. Ramping up regulations take time, but they work on tax schedule. They will win in the end.
- OneTimePetes 5y ago
  It should have been standardized, so it can be auto-negotiated. Not these dark patern menues, but a popup screen: This site overreaches regarding privacy, in addition what you are usually willing to give - it demands: - List Are you willing to give in to the demands: - Just once - Fake my data - Always - Never This could and should have been all you see of GDPR. Maybee technical laws should also enforce a standard for consent interfaces.