4 ms·
> This is bad, because the IP can only be turned into personal information via cooperation of the users internet provider. Not 100% true, you can often trace b
by dutchbrit 3y ago
> This is bad, because the IP can only be turned into personal information via cooperation of the users internet provider.
Not 100% true, you can often trace back users by IP using leaked databases and through companies that sell user data. Might not be legal, but you definitely don't need cooperation from a ISP.
- zpeti 3y agoYou might be able to trace an IP back to a user, but you're absolutely not guaranteed that that IP was only used by that particular user. Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then?
- msm_ 3y ago> Therefore even on a technical level this EU legal interpretation is insane, hundreds or thousands of people can potentially use the same IP address, how is that personal information then? ISP knows exactly who used IP at that point in time (they are even obliged by law to log them). Therefore IP from which a request was sent can be used to uniquely identify the device, with 100% certainty. Therefore it is (usually) a personal information.
- prepend 3y agoI don’t think the goal is to find a single IP for a crime or something. In that case, law enforcement just subpoenas and they’ll sort out the thousands using the IP to the actual person (possible with ISP participation). I don’t think it’s insane because the more common use is just to pattern match to identify the individuals. While lots of people may share, many do not (eg, everyone in my home shared an external IP but that is frequently just one person). Google can use this IP and browser traffic to separate out individuals (eg, I don’t watch YouTube and my kid never checks vanguard) to the level they convince advertisers that they know the individual. I expect this is why my kindergartner sees ads for car insurance.
- ericpauley 3y agoIn that case the database is the PII, not the IP.
- jdietrich 3y agoThe term "personally identifiable information" does not occur anywhere within the text of GDPR. GDPR regulates the use of personal data, which is conceptually much broader than PII. Any data that relates to a natural living person is potentially within the scope of GDPR, including data that is insufficient in isolation to identify a natural living person. For example, pseudonymised data from an employee database or medical records may still constitute personal data if it would be possible to reconstruct the identity of that individual by inference, even if all direct identifiers have been removed. https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en https://commission.europa.eu/law/law-topic/data-protection/r...
- cccbbbaaa 3y agoSo someone can be identified, directly or indirectly, with an IP address, making it personal data under GDPR, art. 4(1).
- joycian 3y agoWhat does "indirectly" include legally?
- cccbbbaaa 3y agoAny piece of information that can be related to someone using supplementary information. Eg. My personnal email address contains my name, so I can be identified direclty; my phone number doesn’t, but my operator and contacts knows who is behind it, so I can be identified indirectly.
- michaelt 3y agoIf Person A has a document saying that Joe Biden lives at 1600 Pennsylvania Avenue and Person B has a document saying an 80 year old male living at 1600 Pennsylvania Avenue has Chlamydia do you think only Person A holds private information?
- themitigating 3y agoIf the IP is dynamic then how would you know who had it at the time?
- agos 3y agoyou make a join between the "user session" and the "user profile" tables
- diffeomorphism 3y agoEasily
- jacquesm 3y agoBecause ISPs are keeping lease logs.
- themitigating 3y agoHow would you get that information?
- jacquesm 3y agoCourt order, security incident, insider access.