3 ms·

> and everything you create and all data stored about you by any social network is, by definition, personal data This isn’t true. This is a common misconceptio

by Shank 3y ago

> and everything you create and all data stored about you by any social network is, by definition, personal data This isn’t true. This is a common misconception. GDPR strictly defines personal data into a narrow band of attributes. Generally any content that you make public that doesn’t identify a natural person or is sensitive by some other definition is not personal data. > Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. > Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. See: https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...

oaiey 3y ago
Your understanding is a bit strange considering that your username below your post makes your post related to a person (you) and is therefore personal data. A contribution to a social network tells something about you. Even if it is just a recipe you share. The only way that would work is when the social network allows 100% anonymous posts. Which is very difficult for liability reasons.
- skybrian 3y ago
  I don't know if this matters for the law, but a username doesn't identify you if it's a pseudonym and you have good opsec. So it seems like whether it's identifying depends on the situation? Where else do you use that username? My username trivially identifies me with a web search. Someone else's might not.
  - oaiey 3y ago
    That is the pseudo-anonymization clause there. Someone can look you up. Even if you are just a number, that is enough, if someone can link the number to an IP an from there to a person.
    - skybrian 3y ago
      Seems like that makes the IP address identifying, not the username?
radicalbyte 3y ago
> This isn’t true. This is a common misconception. GDPR strictly defines personal data into a narrow band of attributes. Generally any content that you make public that doesn’t identify a natural person or is sensitive by some other definition is not personal data. No, this isn't correct. I've spent too many hours in calls with lawyers (from the EC) regarding this. You quoted the exact line that makes it difficult: > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. This is applied very strictly. If you have a datum that can be used to identify a specific person out of *any* arbitrary set of people then that datum is personal information. Remember the COVID apps which worked using pseudorandom numbers shared by bluetooth? Those numbers are personal information despite the technical implementation being required to link person to ID being very hard. Same thing for the SHA2 of a COVID certificate (just the hash, no other information over the holder). Not all regulators apply the laws the same / correctly and commercial companies who have an army of lawyers ride roughneck over the laws because they have bigger pockets than any regulator.
- Shank 3y ago
  > If you have a datum that can be used to identify a specific person out of any arbitrary set of people then that datum is personal information. Exactly. Content that doesn’t identify a natural person isn’t personal information. I don’t think we disagree on this. Conversely any content that can be used to identify a natural person is personal data. If I post “Jack Dorsey is a really cool dude” that’s not personally identifiable information. If I post “I am Lucas Nicodemus and I believe Jack Dorsey is a really cool dude” it is. Similarly, if I post “my unique ID in some system is X and I am a cool dude” it’s also personal information.

by Shank 3y ago

oaiey 3y ago

Your understanding is a bit strange considering that your username below your post makes your post related to a person (you) and is therefore personal data. A contribution to a social network tells something about you. Even if it is just a recipe you share. The only way that would work is when the social network allows 100% anonymous posts. Which is very difficult for liability reasons.

skybrian 3y ago
I don't know if this matters for the law, but a username doesn't identify you if it's a pseudonym and you have good opsec. So it seems like whether it's identifying depends on the situation? Where else do you use that username? My username trivially identifies me with a web search. Someone else's might not.
- oaiey 3y ago
  That is the pseudo-anonymization clause there. Someone can look you up. Even if you are just a number, that is enough, if someone can link the number to an IP an from there to a person.
  - skybrian 3y ago
    Seems like that makes the IP address identifying, not the username?

radicalbyte 3y ago

> This isn’t true. This is a common misconception. GDPR strictly defines personal data into a narrow band of attributes. Generally any content that you make public that doesn’t identify a natural person or is sensitive by some other definition is not personal data. No, this isn't correct. I've spent too many hours in calls with lawyers (from the EC) regarding this. You quoted the exact line that makes it difficult: > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. This is applied very strictly. If you have a datum that can be used to identify a specific person out of *any* arbitrary set of people then that datum is personal information. Remember the COVID apps which worked using pseudorandom numbers shared by bluetooth? Those numbers are personal information despite the technical implementation being required to link person to ID being very hard. Same thing for the SHA2 of a COVID certificate (just the hash, no other information over the holder). Not all regulators apply the laws the same / correctly and commercial companies who have an army of lawyers ride roughneck over the laws because they have bigger pockets than any regulator.

Shank 3y ago
> If you have a datum that can be used to identify a specific person out of any arbitrary set of people then that datum is personal information. Exactly. Content that doesn’t identify a natural person isn’t personal information. I don’t think we disagree on this. Conversely any content that can be used to identify a natural person is personal data. If I post “Jack Dorsey is a really cool dude” that’s not personally identifiable information. If I post “I am Lucas Nicodemus and I believe Jack Dorsey is a really cool dude” it is. Similarly, if I post “my unique ID in some system is X and I am a cool dude” it’s also personal information.