4 ms·
Yes, a name is strictly speaking unnecessary, but you need to actually identify a real person uniquely in the real world. its not PII as long as its impossible
by y4mi 5y ago
Yes, a name is strictly speaking unnecessary, but you need to actually identify a real person uniquely in the real world.
its not PII as long as its impossible to link it back to a unique identification from the real world such as a name, social security number or similar.
so my previous blanket statement of IP addresses not being PII is slightly exaggerated, they can be, but they rarely are.
most people access the internet either with dynamic ip addresses or from a corporations internet providers.
people that have a static ip address on a private landline and without a NAT are rare, which is why generally speaking, IP addresses aren't PII.
it does become PII if the person in question has a static ip address and is the only person using this connection.
- number6 5y agoWould you say that your username is PII? I sure can't identify you in the real world, but I can identify you as a real person. I would consider it PII even if I know nothing else about you other than that I am talking to the same person.
- y4mi 5y agoNo, my username is not PII as there is no lookup table to my real identity. If it was, ycombinator would have to adhere to much more stringent regulation wrt them.
- number6 5y agoOk so this is the point to where we differ. I read Art 4 as follows in this case: You are a natural person who can be indirectly identified by refering to an online identifier (your username). This identifier is therefore personal data. HN also has your IP while and a mail address. So they have a much stronger link. Maybe they also have information about the sites you visited and the comments you made. If one would read all of this, maybe this someone would have a good profile about you and could identify you.
- y4mi 5y agoA natural person is a legal term so it's really not a matter of opinion... Believe it or not, usernames only become PII if the user choose to use their real name or another information which uniquely identifies them in real life
- number6 5y agoOk I guess that we can't reach an understanding in this point. I don't think GDPR needs the real life link, you think it does. I can understand your point and it was nice to entertain this conversation with you. I can't see how to convince you from my view and I don't see how you could convince me of yours. But I will keep you arguments in mind and will look for some more information regarding to it. Thank you!
- y4mi 5y agoI should've realized this earlier but I think I understand now the reason for the confusion. GDPR handles all kinds of data related to a person, so yes: a username is personal data wrt GDPR personally identifiable information (PII) on the other hand is only a subset of data handled by the general data protection regulation (GDPR) This might clear that up https://techgdpr.com/blog/difference-between-pii-and-personal-data/ https://techgdpr.com/blog/difference-between-pii-and-persona...
- number6 5y agoYes! I used PII and Personal Data synonymous and didn't realise that PII is a subset of personal data. I am glad you took the time to correct me. Man I feel stupid now...