4 ms·

An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not

by bserge 5y ago

An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?

gjs278 5y ago
it definitely is someone
owlmirror 5y ago
PII can be anything unique tied to a person. email addresses are definitely PII. even if you have not the full name of a person in the address, such an address usually is unique to a single person and as such one of the best identifiers you will usually have.
usr1106 5y ago
IANAL, but IIRC PII/PID is a US concept. The GDPR does not talk about such thing at all. Back when GDPR was new there quite some discussion about the differences. Don't remember the details. Maybe someone can remind us.
- deleted 5y ago
  [deleted]
BeniBoy 5y ago
As a sibling comment said, the notion is "Personal Data". It is very wide and email address definitely fall within it. Also note IP is personal data, and an identifier like a UUID of the IDFA is personal data. The key point is that it must be related to an identified *or identifiable* data subject, ie even if that information is not enough to identify the person, the fact that it can contribute to it makes it personal data.
dafoex 5y ago
With that information I can: • Say with a lot of confidence that billy69420@cbt.eu is owned by one person, called William. • Infer that, since the e-mail says Billy, but the name says William, the latter is probably what appears on any official documentation. • Infer that any services signed up to using billy69420@cbt.eu as the e-mail address are more than likely tied to this William person - including any services I run or otherwise have administrative access to. • Search for billy69420@cbt.eu on various public information repositories and reverse email searches. • Add an entry to a database using billy69420@cbt.eu as a primary key (e-mail addresses are necessarily unique) to enable me to keep track of my current and future information and inferences, thus building a profile on the person. I can also understand that the sex and weed references mean that you've probably not given a real e-mail in this example, but if it were real I might be able to infer an age range (or at least a level of maturity) of the user from that, although this would be unreliable as the user could have made the e-mail account some time ago and just still happen to be using it.
- bserge 5y ago
  From OPs link to the official guidelines: "If data are inaccurate to the point that no individual can be identified, then the information is not personal data. (e.g. If you refer to “the man who lives at 12 Mulberry Lane had a party last night,” when Mulberry Lane ends at number 10, that’s not personal data.). I could guess "12" was a mistake and just send spam or visit the man living at number 10. That's way more dangerous imo than an old skool email address and a first name. Yet it's apparently not considered personal data. That's why I asked, actually, since it confused me.
- currency 5y ago
  Plenty of addresses are designed to mislead. Twitter bots, especially. You can't actually assume good faith on the part of the owner of the address.
  - TeMPOraL 5y ago
    You can at scale. Separating bots from real people is a somewhat orthogonal concern, and given a large dataset containing mostly real people, you can safely assume vast majority of the data is not purposefully misleading. Vast majority is good enough for advertising, and mistakes in non-advertising use usually create a problem for the e-mail owner, not the database user.
rlpb 5y ago
The test is whether that information can later be used to link to an individual. You might not have the information, but you might later be able to correlate it against someone who does, and that makes it personally identifiable and under the scope of the GDPR. Here's a citation: "If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

by bserge 5y ago

An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?

gjs278 5y ago

it definitely is someone

owlmirror 5y ago

PII can be anything unique tied to a person. email addresses are definitely PII. even if you have not the full name of a person in the address, such an address usually is unique to a single person and as such one of the best identifiers you will usually have.

usr1106 5y ago

IANAL, but IIRC PII/PID is a US concept. The GDPR does not talk about such thing at all. Back when GDPR was new there quite some discussion about the differences. Don't remember the details. Maybe someone can remind us.

deleted 5y ago
[deleted]

BeniBoy 5y ago

As a sibling comment said, the notion is "Personal Data". It is very wide and email address definitely fall within it. Also note IP is personal data, and an identifier like a UUID of the IDFA is personal data. The key point is that it must be related to an identified *or identifiable* data subject, ie even if that information is not enough to identify the person, the fact that it can contribute to it makes it personal data.

dafoex 5y ago

With that information I can: • Say with a lot of confidence that billy69420@cbt.eu is owned by one person, called William. • Infer that, since the e-mail says Billy, but the name says William, the latter is probably what appears on any official documentation. • Infer that any services signed up to using billy69420@cbt.eu as the e-mail address are more than likely tied to this William person - including any services I run or otherwise have administrative access to. • Search for billy69420@cbt.eu on various public information repositories and reverse email searches. • Add an entry to a database using billy69420@cbt.eu as a primary key (e-mail addresses are necessarily unique) to enable me to keep track of my current and future information and inferences, thus building a profile on the person. I can also understand that the sex and weed references mean that you've probably not given a real e-mail in this example, but if it were real I might be able to infer an age range (or at least a level of maturity) of the user from that, although this would be unreliable as the user could have made the e-mail account some time ago and just still happen to be using it.

bserge 5y ago
From OPs link to the official guidelines: "If data are inaccurate to the point that no individual can be identified, then the information is not personal data. (e.g. If you refer to “the man who lives at 12 Mulberry Lane had a party last night,” when Mulberry Lane ends at number 10, that’s not personal data.). I could guess "12" was a mistake and just send spam or visit the man living at number 10. That's way more dangerous imo than an old skool email address and a first name. Yet it's apparently not considered personal data. That's why I asked, actually, since it confused me.
currency 5y ago
Plenty of addresses are designed to mislead. Twitter bots, especially. You can't actually assume good faith on the part of the owner of the address.
- TeMPOraL 5y ago
  You can at scale. Separating bots from real people is a somewhat orthogonal concern, and given a large dataset containing mostly real people, you can safely assume vast majority of the data is not purposefully misleading. Vast majority is good enough for advertising, and mistakes in non-advertising use usually create a problem for the e-mail owner, not the database user.

rlpb 5y ago

The test is whether that information can later be used to link to an individual. You might not have the information, but you might later be able to correlate it against someone who does, and that makes it personally identifiable and under the scope of the GDPR. Here's a citation: "If you cannot directly identify an individual from that information, then you need to consider whether the individual is still identifiable. You should take into account the information you are processing together with all the means reasonably likely to be used by either you or any other person to identify that individual." https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/ https://ico.org.uk/for-organisations/guide-to-data-protectio...