3 ms·

There is, I think, some legal uncertainty about what it means for someone to be "identified indirectly", so a court might agree with you, but I think there is a

There is, I think, some legal uncertainty about what it means for someone to be "identified indirectly", so a court might agree with you, but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". Here's what the University College London's guidance[0] says: "Once data is truly anonymised and individuals are no longer identifiable, the data will not fall within the scope of the GDPR and it becomes easier to use." Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. It's true that timestamps could give an idea of which timezone the user is in, but that shouldn't necessarily reveal even the country the user is in. [0] https://www.ucl.ac.uk/data-protection/guidance-staff-students-and-researchers/practical-data-protection-guidance-notices/anonymisation-and#Pseudonymisation https://www.ucl.ac.uk/data-protection/guidance-staff-student...

wizzwizz4 5y ago
> but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". It can't be defined that way. Consider: • Company A collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company B collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company C collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Facebook identifies a specific natural person. GDPR protects against this. > Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. Good – GDPR calls this the principle of data minimisation. But the data is still going through your systems, when it doesn't really need to be created (however briefly) in the first place. Certainly not via software that people had no reason to expect would be executing on their computer. Honestly, GDPR is the least of your worries; one might consider that malicious software, and then you've got the whole book ready to be thrown at your head.
- dane-pgp 5y ago
  > • Facebook identifies a specific natural person. This is the point when the GDPR kicks in, and Facebook would be expected to know that the combination of the data they obtain from A, B, and C is enough to identify someone (even if Facebook never actually combined the data to produce those identities). The fact that Facebook are paying money for the data (in this hypothetical scenario) means they should know the value of the data and what can be done with it. > one might consider that malicious software, and then you've got the whole book ready to be thrown at your head. I'd love there to be a case where some company got the book thrown at them for anonymous (or even non-anonymous) telemetry. Did anything happen after the Irish and Dutch investigations into Windows 10 telemetry? https://www.techradar.com/uk/news/windows-10-could-still-be-snooping-on-user-data https://www.techradar.com/uk/news/windows-10-could-still-be-...
  - wizzwizz4 5y ago
    > This is the point when the GDPR kicks in, In the real world, Facebook doesn't trade money, but services, for this data. (Mostly.) And the GDPR applies all the time. Do companies have a “legitimate interest” to give pseudonymised transaction data to Facebook (pseudonymised using Facebook's answer key), in return for “marketing and business insights”, without the consent of those whose data is being traded? I'm pretty sure that doesn't fall under legitimate interest, and there isn't another GDPR reason that might apply.

wizzwizz4 5y ago

> but I think there is also a widely accepted opinion that if data can't be connected back to a specific natural person by the data controller/processor, then it is no longer "personal data". It can't be defined that way. Consider: • Company A collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company B collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Company C collects data that it can't connect back to a specific natural person, and sells it to Facebook. • Facebook identifies a specific natural person. GDPR protects against this. > Obviously in the system I am proposing, the data controller/processor would have to deliberately not log the IP address or a user agent string. Good – GDPR calls this the principle of data minimisation. But the data is still going through your systems, when it doesn't really need to be created (however briefly) in the first place. Certainly not via software that people had no reason to expect would be executing on their computer. Honestly, GDPR is the least of your worries; one might consider that malicious software, and then you've got the whole book ready to be thrown at your head.

dane-pgp 5y ago
> • Facebook identifies a specific natural person. This is the point when the GDPR kicks in, and Facebook would be expected to know that the combination of the data they obtain from A, B, and C is enough to identify someone (even if Facebook never actually combined the data to produce those identities). The fact that Facebook are paying money for the data (in this hypothetical scenario) means they should know the value of the data and what can be done with it. > one might consider that malicious software, and then you've got the whole book ready to be thrown at your head. I'd love there to be a case where some company got the book thrown at them for anonymous (or even non-anonymous) telemetry. Did anything happen after the Irish and Dutch investigations into Windows 10 telemetry? https://www.techradar.com/uk/news/windows-10-could-still-be-snooping-on-user-data https://www.techradar.com/uk/news/windows-10-could-still-be-...
- wizzwizz4 5y ago
  > This is the point when the GDPR kicks in, In the real world, Facebook doesn't trade money, but services, for this data. (Mostly.) And the GDPR applies all the time. Do companies have a “legitimate interest” to give pseudonymised transaction data to Facebook (pseudonymised using Facebook's answer key), in return for “marketing and business insights”, without the consent of those whose data is being traded? I'm pretty sure that doesn't fall under legitimate interest, and there isn't another GDPR reason that might apply.