4 ms·

What about anonymous logging of which buttons people click on is illegal in the EU? Citation needed on this one. That would make any dashboard that showed whi

What about anonymous logging of which buttons people click on is illegal in the EU? Citation needed on this one. That would make any dashboard that showed which api endpoints are the most popular also illegal. Anomyous telemetry is not PII. GDPR is personal data.

nness 4y ago
As long as there's no "session identifier," even if unique and completely unmarriable to the PII, it doesn't matter. Any session ID where an ID represents one person runs afoul. Makes meaningful telemetry really hard without consent. Everyone just consents anyway...
- abigail95 4y ago
  My position is they can indeed get meaningful telemetry with opt-out anonymised data and that the GDPR does not prevent this. I am countering the position of the parent poster and asking for a citation that would indicate you don't need to sneak this around the EU regulators to do it.
- alpaca128 4y ago
  > Everyone just consents anyway... Unless you don't lie to them and don't use every dark pattern in the book to trick them into clicking the checkbox.
JohnFen 4y ago
> Anomyous telemetry is not PII. That depends. First, no data collection is "anonymous" when it is transmitted. Any anonymity must come later, and then is only possible if the company aggregates the data with other users and deletes the original data that was collected. PII/Personal Data are squishy terms. In the US, anyway, the legal definitions of what counts as "PII" leaves out an awful lot of actual PII -- so any claims that "no PII is being collected" is meaningless without additional explanation of what data items are being collected.
- abigail95 4y ago
  We are talking EU and I specifically asked for Citation needed, and I realize you aren't the poster but this doesn't really answer my question. Are we assuming 1Password is lying about anonymisation? My point is they didn't "sneak it past the regulators", it's plainly legal to do this under GDPR, and if it isn't I need a citation.
  - JohnFen 4y ago
    > Are we assuming 1Password is lying about anonymisation? I wouldn't put it that way. Rather, I'd say that you shouldn't assume something is true just because a company claims it is. Especially when that thing can have a material effect on their profit margin.
    - abigail95 4y ago
      In simplest terms. 1P says they are collecting non-PII. Higher poster in this thread says "I can't imagine how they're going to get this past EU regulators." I'm saying there is no problem, and someone needs to provide proof that the opt-out here is illegal.
      - closewith 4y ago
        Well, in the EU, the onus is on the data processer to show compliance, not the other way around. However, Recital 30 (Online Identifiers for Profiling and Identification) clearly shows that IP addresses are personal data; > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. 2This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. There is plenty of case law to show that processing IP addresses (even if you discard them later) is processing personal data. For example, an Italian court included as part of a ruling: > In this respect, it is worth pointing out that the IP address constitutes personal data insofar as it makes it possible to identify an electronic communication device, thus indirectly making the data subject identifiable as a user (see Article 29 Working Party, WP 136 - Opinion No 4/2007 on the concept of personal data, of 20 June 2007, p. 16). This is especially so where, as in the present case, the IP is associated with other information relating to the browser used and the date and time of browsing (see recital 30 of the Regulation). Source: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9782890 https://gdprhub.eu/index.php?title=Garante_per_la_protezione...
miken123 4y ago
> Anomyous telemetry is not PII. GDPR is personal data. How are you exactly going to submit it anonymously? Will it connect over Tor? Because if you just send it over your internet connection, it arrives with your IP address on the packets, which is PII, which makes it data processing of PII, which makes it require a legal basis to process. And it is legally uncertain that 'legitimate interest' is a valid ground for telemetry data, leaving only opt-in consent.
- abigail95 4y ago
  That would make any EU company running a server in a country without an EU data processing treaty illegal, because the IP address would be in the TCP handshake. Edit: It would also violate using any networks that transit such countries, because TLS and TCP handshake info might be PII too. I find that such a ridiculous position to have re GDPR. 1P already has consent from users for its apps to use the network to connect to their services. They do not need an additional agreement ie opt-in consent. If they are collecting non-PII they can use the current opt out.
  - closewith 4y ago
    > That would make any EU company running a server in a country without an EU data processing treaty illegal, because the IP address would be in the TCP handshake. Yes, and this is the current situation with the US following Schrems II. Obviously, lots of companies are non-compliant as everyone is waiting for a diplomatic solution following the ruling against Privacy Shield. > 1P already has consent from users for its apps to use the network to connect to their services. They probably rely on the strictly necessary legal basis for network connections that are required to run the service. However, each purpose much have its own legal basis and you cannot bundle purposes. For example, you cannot gain consent to process given personal data for one purpose and then process it for another purpose. Consent must be bound to one or several specified purposes which must then be sufficiently explained.

nness 4y ago

As long as there's no "session identifier," even if unique and completely unmarriable to the PII, it doesn't matter. Any session ID where an ID represents one person runs afoul. Makes meaningful telemetry really hard without consent. Everyone just consents anyway...

abigail95 4y ago
My position is they can indeed get meaningful telemetry with opt-out anonymised data and that the GDPR does not prevent this. I am countering the position of the parent poster and asking for a citation that would indicate you don't need to sneak this around the EU regulators to do it.
alpaca128 4y ago
> Everyone just consents anyway... Unless you don't lie to them and don't use every dark pattern in the book to trick them into clicking the checkbox.

JohnFen 4y ago

> Anomyous telemetry is not PII. That depends. First, no data collection is "anonymous" when it is transmitted. Any anonymity must come later, and then is only possible if the company aggregates the data with other users and deletes the original data that was collected. PII/Personal Data are squishy terms. In the US, anyway, the legal definitions of what counts as "PII" leaves out an awful lot of actual PII -- so any claims that "no PII is being collected" is meaningless without additional explanation of what data items are being collected.

abigail95 4y ago
We are talking EU and I specifically asked for Citation needed, and I realize you aren't the poster but this doesn't really answer my question. Are we assuming 1Password is lying about anonymisation? My point is they didn't "sneak it past the regulators", it's plainly legal to do this under GDPR, and if it isn't I need a citation.
- JohnFen 4y ago
  > Are we assuming 1Password is lying about anonymisation? I wouldn't put it that way. Rather, I'd say that you shouldn't assume something is true just because a company claims it is. Especially when that thing can have a material effect on their profit margin.
  - abigail95 4y ago
    In simplest terms. 1P says they are collecting non-PII. Higher poster in this thread says "I can't imagine how they're going to get this past EU regulators." I'm saying there is no problem, and someone needs to provide proof that the opt-out here is illegal.
    - closewith 4y ago
      Well, in the EU, the onus is on the data processer to show compliance, not the other way around. However, Recital 30 (Online Identifiers for Profiling and Identification) clearly shows that IP addresses are personal data; > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. 2This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. There is plenty of case law to show that processing IP addresses (even if you discard them later) is processing personal data. For example, an Italian court included as part of a ruling: > In this respect, it is worth pointing out that the IP address constitutes personal data insofar as it makes it possible to identify an electronic communication device, thus indirectly making the data subject identifiable as a user (see Article 29 Working Party, WP 136 - Opinion No 4/2007 on the concept of personal data, of 20 June 2007, p. 16). This is especially so where, as in the present case, the IP is associated with other information relating to the browser used and the date and time of browsing (see recital 30 of the Regulation). Source: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9782890 https://gdprhub.eu/index.php?title=Garante_per_la_protezione...

miken123 4y ago

> Anomyous telemetry is not PII. GDPR is personal data. How are you exactly going to submit it anonymously? Will it connect over Tor? Because if you just send it over your internet connection, it arrives with your IP address on the packets, which is PII, which makes it data processing of PII, which makes it require a legal basis to process. And it is legally uncertain that 'legitimate interest' is a valid ground for telemetry data, leaving only opt-in consent.

abigail95 4y ago
That would make any EU company running a server in a country without an EU data processing treaty illegal, because the IP address would be in the TCP handshake. Edit: It would also violate using any networks that transit such countries, because TLS and TCP handshake info might be PII too. I find that such a ridiculous position to have re GDPR. 1P already has consent from users for its apps to use the network to connect to their services. They do not need an additional agreement ie opt-in consent. If they are collecting non-PII they can use the current opt out.
- closewith 4y ago
  > That would make any EU company running a server in a country without an EU data processing treaty illegal, because the IP address would be in the TCP handshake. Yes, and this is the current situation with the US following Schrems II. Obviously, lots of companies are non-compliant as everyone is waiting for a diplomatic solution following the ruling against Privacy Shield. > 1P already has consent from users for its apps to use the network to connect to their services. They probably rely on the strictly necessary legal basis for network connections that are required to run the service. However, each purpose much have its own legal basis and you cannot bundle purposes. For example, you cannot gain consent to process given personal data for one purpose and then process it for another purpose. Consent must be bound to one or several specified purposes which must then be sufficiently explained.