4 ms·

At least in Germany the court ruled that an IP address is not PII A unique identifier which let's them track a user everywhere isn't either if there is no way

by y4mi 5y ago

At least in Germany the court ruled that an IP address is not PII A unique identifier which let's them track a user everywhere isn't either if there is no way to match this id to a real name etc They will likely still need to disclose this tracking (ianal), but the identifier used to track the visits isn't PII

number6 5y ago
My last info is that the ECJ ruled that IP addresses are PII. And as I quoted above it doesn't matter if information can be matched to a real name but it matters if you can single out one person e.g. a unique visitor.
- y4mi 5y ago
  you quoted something which i think you misunderstood. the natural person is the link to a real name. it only becomes PII if its somehow possible to link a real name or similar to this identifier. If this is impossible, it will never be PII, even if it identifies a single individual.
  - number6 5y ago
    This would be a massive misunderstanding on my part. I don't believe I did. For example: Recital 30 explicitly states IP addresses[0] and that they might be assigned to a person. Art 4 states that a person can be directly identified or indirectly identified. My understanding is, that you don't need any direct information about a person if you can single them out with indirect information. "However, a name is not always necessary. Had you not known Robert’s name, you could have still identified him through his proximity and some combination of physical factors, like height and hair color."[1] I don't think I am wrong here. But I am willing to admit when I am wrong, where is my mistake? [0]https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/ [1]https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1 https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1
    - y4mi 5y ago
      Yes, a name is strictly speaking unnecessary, but you need to actually identify a real person uniquely in the real world. its not PII as long as its impossible to link it back to a unique identification from the real world such as a name, social security number or similar. so my previous blanket statement of IP addresses not being PII is slightly exaggerated, they can be, but they rarely are. most people access the internet either with dynamic ip addresses or from a corporations internet providers. people that have a static ip address on a private landline and without a NAT are rare, which is why generally speaking, IP addresses aren't PII. it does become PII if the person in question has a static ip address and is the only person using this connection.
      - number6 5y ago
        Would you say that your username is PII? I sure can't identify you in the real world, but I can identify you as a real person. I would consider it PII even if I know nothing else about you other than that I am talking to the same person.
        y4mi 5y ago
        No, my username is not PII as there is no lookup table to my real identity. If it was, ycombinator would have to adhere to much more stringent regulation wrt them.
        number6 5y ago
        Ok so this is the point to where we differ. I read Art 4 as follows in this case: You are a natural person who can be indirectly identified by refering to an online identifier (your username). This identifier is therefore personal data. HN also has your IP while and a mail address. So they have a much stronger link. Maybe they also have information about the sites you visited and the comments you made. If one would read all of this, maybe this someone would have a good profile about you and could identify you.
        5y ago

by y4mi 5y ago

number6 5y ago

My last info is that the ECJ ruled that IP addresses are PII. And as I quoted above it doesn't matter if information can be matched to a real name but it matters if you can single out one person e.g. a unique visitor.

y4mi 5y ago
you quoted something which i think you misunderstood. the natural person is the link to a real name. it only becomes PII if its somehow possible to link a real name or similar to this identifier. If this is impossible, it will never be PII, even if it identifies a single individual.
- number6 5y ago
  This would be a massive misunderstanding on my part. I don't believe I did. For example: Recital 30 explicitly states IP addresses[0] and that they might be assigned to a person. Art 4 states that a person can be directly identified or indirectly identified. My understanding is, that you don't need any direct information about a person if you can single them out with indirect information. "However, a name is not always necessary. Had you not known Robert’s name, you could have still identified him through his proximity and some combination of physical factors, like height and hair color."[1] I don't think I am wrong here. But I am willing to admit when I am wrong, where is my mistake? [0]https://gdpr-info.eu/recitals/no-30/ https://gdpr-info.eu/recitals/no-30/ [1]https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1 https://gdpr.eu/eu-gdpr-personal-data/?cn-reloaded=1
  - y4mi 5y ago
    Yes, a name is strictly speaking unnecessary, but you need to actually identify a real person uniquely in the real world. its not PII as long as its impossible to link it back to a unique identification from the real world such as a name, social security number or similar. so my previous blanket statement of IP addresses not being PII is slightly exaggerated, they can be, but they rarely are. most people access the internet either with dynamic ip addresses or from a corporations internet providers. people that have a static ip address on a private landline and without a NAT are rare, which is why generally speaking, IP addresses aren't PII. it does become PII if the person in question has a static ip address and is the only person using this connection.
    - number6 5y ago
      Would you say that your username is PII? I sure can't identify you in the real world, but I can identify you as a real person. I would consider it PII even if I know nothing else about you other than that I am talking to the same person.
      - y4mi 5y ago
        No, my username is not PII as there is no lookup table to my real identity. If it was, ycombinator would have to adhere to much more stringent regulation wrt them.
        number6 5y ago
        Ok so this is the point to where we differ. I read Art 4 as follows in this case: You are a natural person who can be indirectly identified by refering to an online identifier (your username). This identifier is therefore personal data. HN also has your IP while and a mail address. So they have a much stronger link. Maybe they also have information about the sites you visited and the comments you made. If one would read all of this, maybe this someone would have a good profile about you and could identify you.
        5y ago