4 ms·

You seem to be confused about what PII is (which I think you meant from context). None of the listed informations are PII, nor do they become that in aggregatio

by y4mi 5y ago

You seem to be confused about what PII is (which I think you meant from context). None of the listed informations are PII, nor do they become that in aggregation. But if it was, it most likely would be enough anyway if the salt isn't stored anywhere. An irreversible hash of data is enough anonymization

number6 5y ago
You are right: PII. Sorry. So PII are Informationen that enable someone to identify a person as a unique person. On the homepage is stated: "This generates a random string of letters and numbers that is used to calculate unique visitor numbers for the day." Where the definition of personal data is: "(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" So if the listed information isn't PII (an IP address however is PII) then it would become PII if you can identify a unique visitor with it. Am I wrong here? It sounds to me that this hash fits the definition of Art. 4
- rvnx 5y ago
  This is equivalent of replacing the IP address with a pseudonym that is rotated daily per each IP address. Privacy improvements using crypto is somewhat marketing, but here the numbers show that they have a really good product, an impressive revenue model and a good marketing message so I think that's what we should look at. Technically, at the end of the day, they store utm_source, they store the IP address (just in an encoded form with a salt + day added to it). -> So yeah, you can be tracked, but in theory you will appear under a pseudonymised hash of your IP+UA.
- bopbeepboop 5y ago
  I give you the hash as described above. How do you identify me from that data? > an identifiable natural person is one who can be identified, directly or indirectly, in particular by [the data] Since you are not identified by the metrics and not identifiable by the hash, I’m not understanding your concern.
- y4mi 5y ago
  At least in Germany the court ruled that an IP address is not PII A unique identifier which let's them track a user everywhere isn't either if there is no way to match this id to a real name etc They will likely still need to disclose this tracking (ianal), but the identifier used to track the visits isn't PII
  - number6 5y ago
    My last info is that the ECJ ruled that IP addresses are PII. And as I quoted above it doesn't matter if information can be matched to a real name but it matters if you can single out one person e.g. a unique visitor.
    - y4mi 5y ago
      you quoted something which i think you misunderstood. the natural person is the link to a real name. it only becomes PII if its somehow possible to link a real name or similar to this identifier. If this is impossible, it will never be PII, even if it identifies a single individual.
      - number6 5y ago
        This would be a massive misunderstanding on my part. I don't believe I did. For example: Recital 30 explicitly states IP addresses[0] and that they might be assigned to a person. Art 4 states that a person can be directly identified or indirectly identified. My understanding is, that you don't need any direct information about a person if you can single them out with indirect information. "However, a name is not always necessary. Had you not known Robert’s name, you could have still identified him through his proximity and some combination of physical factors, like height and hair color."[1] I don't think I am wrong here. But I am willing to admit when I am wrong, where is my mistake? [0]https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/ [1]https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1 https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1
        y4mi 5y ago

by y4mi 5y ago

number6 5y ago

You are right: PII. Sorry. So PII are Informationen that enable someone to identify a person as a unique person. On the homepage is stated: "This generates a random string of letters and numbers that is used to calculate unique visitor numbers for the day." Where the definition of personal data is: "(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" So if the listed information isn't PII (an IP address however is PII) then it would become PII if you can identify a unique visitor with it. Am I wrong here? It sounds to me that this hash fits the definition of Art. 4

rvnx 5y ago
This is equivalent of replacing the IP address with a pseudonym that is rotated daily per each IP address. Privacy improvements using crypto is somewhat marketing, but here the numbers show that they have a really good product, an impressive revenue model and a good marketing message so I think that's what we should look at. Technically, at the end of the day, they store utm_source, they store the IP address (just in an encoded form with a salt + day added to it). -> So yeah, you can be tracked, but in theory you will appear under a pseudonymised hash of your IP+UA.
bopbeepboop 5y ago
I give you the hash as described above. How do you identify me from that data? > an identifiable natural person is one who can be identified, directly or indirectly, in particular by [the data] Since you are not identified by the metrics and not identifiable by the hash, I’m not understanding your concern.
y4mi 5y ago
At least in Germany the court ruled that an IP address is not PII A unique identifier which let's them track a user everywhere isn't either if there is no way to match this id to a real name etc They will likely still need to disclose this tracking (ianal), but the identifier used to track the visits isn't PII
- number6 5y ago
  My last info is that the ECJ ruled that IP addresses are PII. And as I quoted above it doesn't matter if information can be matched to a real name but it matters if you can single out one person e.g. a unique visitor.
  - y4mi 5y ago
    you quoted something which i think you misunderstood. the natural person is the link to a real name. it only becomes PII if its somehow possible to link a real name or similar to this identifier. If this is impossible, it will never be PII, even if it identifies a single individual.
    - number6 5y ago
      This would be a massive misunderstanding on my part. I don't believe I did. For example: Recital 30 explicitly states IP addresses[0] and that they might be assigned to a person. Art 4 states that a person can be directly identified or indirectly identified. My understanding is, that you don't need any direct information about a person if you can single them out with indirect information. "However, a name is not always necessary. Had you not known Robert’s name, you could have still identified him through his proximity and some combination of physical factors, like height and hair color."[1] I don't think I am wrong here. But I am willing to admit when I am wrong, where is my mistake? [0]https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/ [1]https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1 https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1
      - y4mi 5y ago