5 ms·

This is not true legally. If there is no way to link back to you personally then it is not PII.

by Entinel 4y ago

Ruthalas 4y ago
Correct me if I am wrong, but it's going to be tied to your IP address. So it will be tied to a unique identifier.
- dspillett 4y ago
  As has been repeatedly argued in cases of IP-rights-holders-vs-sharers, an IP address on its own does not identify an individual. We argue that both ways depending on what suits us at the time, or we are as bad as the music industry flipping between “you bought the CD” and “you licensed the music” when it suits them to.
  - Ruthalas 4y ago
    That's fair. (Though I certainly haven't argued it either way previously myself.) I do think it makes your statement that cannot, "be linked back to you personally", a little less absolute.
    - dspillett 4y ago
      That was someone-else's statement, not mine. My take: An IP address is usually not, in fact almost always not, PII on its own, but there are circumstances where it is part of a package of data that is PII, and others where it could be considered “circumstantial PII”.
  - Nullabillity 4y ago
    There's a huge difference between "identifiable enough to be legal evidence" and "identifiable enough to be unethical to collect".
  - Timon3 4y ago
    This is only true in certain jurisdictions. The GDPR recitals specifically mention IP addresses as examples of personal data: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. from https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/ https://gdpr.eu/recital-30-online-identifiers-for-profiling-... Further support for this interpretation in case the above comes off as "only if combined with other data": https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
sneak 4y ago
I didn't say it was personally identifiable. I said it was personal info; i.e. yours.

This is not true legally. If there is no way to link back to you personally then it is not PII.

Ruthalas 4y ago

Correct me if I am wrong, but it's going to be tied to your IP address. So it will be tied to a unique identifier.

dspillett 4y ago
As has been repeatedly argued in cases of IP-rights-holders-vs-sharers, an IP address on its own does not identify an individual. We argue that both ways depending on what suits us at the time, or we are as bad as the music industry flipping between “you bought the CD” and “you licensed the music” when it suits them to.
- Ruthalas 4y ago
  That's fair. (Though I certainly haven't argued it either way previously myself.) I do think it makes your statement that cannot, "be linked back to you personally", a little less absolute.
  - dspillett 4y ago
    That was someone-else's statement, not mine. My take: An IP address is usually not, in fact almost always not, PII on its own, but there are circumstances where it is part of a package of data that is PII, and others where it could be considered “circumstantial PII”.
- Nullabillity 4y ago
  There's a huge difference between "identifiable enough to be legal evidence" and "identifiable enough to be unethical to collect".
- Timon3 4y ago
  This is only true in certain jurisdictions. The GDPR recitals specifically mention IP addresses as examples of personal data: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. from https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/ https://gdpr.eu/recital-30-online-identifiers-for-profiling-... Further support for this interpretation in case the above comes off as "only if combined with other data": https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...

sneak 4y ago

I didn't say it was personally identifiable. I said it was personal info; i.e. yours.