11 ms·

.

• Shank 4y ago
  GDPR PII is defined as such: > ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (Article 4)
• thwayunion 4y ago
  > Any free-form field must be treated as PII. I've definitely never received this advice. I think your DPO/counsel are being excessively risk-averse, but IANA(EU)L.
• lol768 4y ago
  Nonsense. If you're made aware you're storing PII, fine. That's different. If it's a field designed for something else, and you have no knowledge it's being used to store PII? You're not going to get a penalty for that. This isn't American law, where everything seems to be decided based on technicalities and the exact wording of the law. These decisions are made by reasonable human beings who review the facts of the situation and come to a judgement.