43 ms·

> First, no data collection is "anonymous" Because no network connection is anonymous but as long as you aren't handling PII, GDPR has nothing to say about it.

> First, no data collection is "anonymous" Because no network connection is anonymous but as long as you aren't handling PII, GDPR has nothing to say about it. I could sell an app in the EU that just pinged my server once a day. As long as I wasn't keeping a record of who pinged what when, there is no PII. Otherwise everything is PII and you would need consent before every TCP handshake.

JohnFen 4y ago
> Because no network connection is anonymous but as long as you aren't handling PII It's not the network connection that eliminates anonymity (although that, too), but the data itself. Even if there's no single piece of PII involved, fingerprinting is still a thing. That's why, if you want a hope at anonymity, you have to add the collected data into an aggregate collection and delete the original data records.
miken123 4y ago
> I could sell an app in the EU that just pinged my server once a day. As long as I wasn't keeping a record of who pinged what when, there is no PII. Data processing is not just about 'keeping a record'. Processing even for a millisecond is also processing. > Otherwise everything is PII and you would need consent before every TCP handshake. Consent is not the only ground for data processing. Normally, it would just be performance of a contract, as the user wants something from you.
- abigail95 4y ago
  I still haven't got my citation of how the GDPR someone applies to non-PII, which is the entire point of what 1P is saying they are collecting. Data processing of personal data is what the GDPR is concerned about. I'm sorry for getting frustrated but for fucks sake, someone cite me something that proves my original point about the opt-out being illegal. I don't care if I'm wrong but I'm not taking downvotes for questioning someone flatly accusing 1P of bypassing EU regulations.
closewith 4y ago
No, IP address is personal data by the EU definition and you need a legal basis to process it. The strictly necessary legal basis allows for TCP connections required to provide the requested service. It is clear that the EU does not consider telemetry to be strictly necessary and while there can be times when telemetry is allowable with the legitimate interest legal basis (for example, to prevent fraud or to comply with legal obligations), there is already plenty of case law across the EU that shows that the legitimate interest legal basis will not be accepted for user analytics. For this reason, it seems unlikely that the proposed telemetry will be compliant in the EU.

JohnFen 4y ago

> Because no network connection is anonymous but as long as you aren't handling PII It's not the network connection that eliminates anonymity (although that, too), but the data itself. Even if there's no single piece of PII involved, fingerprinting is still a thing. That's why, if you want a hope at anonymity, you have to add the collected data into an aggregate collection and delete the original data records.

miken123 4y ago

> I could sell an app in the EU that just pinged my server once a day. As long as I wasn't keeping a record of who pinged what when, there is no PII. Data processing is not just about 'keeping a record'. Processing even for a millisecond is also processing. > Otherwise everything is PII and you would need consent before every TCP handshake. Consent is not the only ground for data processing. Normally, it would just be performance of a contract, as the user wants something from you.

abigail95 4y ago
I still haven't got my citation of how the GDPR someone applies to non-PII, which is the entire point of what 1P is saying they are collecting. Data processing of personal data is what the GDPR is concerned about. I'm sorry for getting frustrated but for fucks sake, someone cite me something that proves my original point about the opt-out being illegal. I don't care if I'm wrong but I'm not taking downvotes for questioning someone flatly accusing 1P of bypassing EU regulations.

closewith 4y ago

No, IP address is personal data by the EU definition and you need a legal basis to process it. The strictly necessary legal basis allows for TCP connections required to provide the requested service. It is clear that the EU does not consider telemetry to be strictly necessary and while there can be times when telemetry is allowable with the legitimate interest legal basis (for example, to prevent fraud or to comply with legal obligations), there is already plenty of case law across the EU that shows that the legitimate interest legal basis will not be accepted for user analytics. For this reason, it seems unlikely that the proposed telemetry will be compliant in the EU.