3 ms·

> Previous research has shown that Xandr collects hundreds of sensitive profiles of Europeans containing information about their health, sex life or sexual orie

> Previous research has shown that Xandr collects hundreds of sensitive profiles of Europeans containing information about their health, sex life or sexual orientation, political or philosophical opinions, religious beliefs or financial status. Specific segments include things like ‘french_disability’, ‘pregnant’, ‘lgbt’, ‘gender_equality’ and ‘jewishfrench’. I don't read German (which I think the justifying article is written in) - is this linking directly to personally identifiable information? If I have an ID in a cookie that links to these groupings, it is not necessarily the same as a GDPR breach. Would someone mind clarifying this one who's more familiar with Xandr/reading German?

Y-bar 2y ago
I think Article 4, section 1 answers your question with regards to online identifiers such as cookies: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
- robertlagrant 2y ago
  I don't think it fits the bill. If I tell you I have a cookie with ID jeeg274642, how are you going to identify me? That's different to thing like a Twitter handle that can be traced straight to a person, as some can.
  - Y-bar 2y ago
    Because I know where jeeg274642 belongs in the set of [gender, nationality_and_region, age_group, pregnancy_status, ...]. Just like a Social Security Number, a cookie (or whatever storage tech is used) need not contain the exact data of the individual, it only need to reference or be precise enough it for it to be a means of identifying them.
    - robertlagrant 2y ago
      Okay, but what do you actually do to identify? A social security number is a 1:1 to a person, if I understand them correctly. It's a direct ID number which lots of relatively low-paid, bribeable people can translate into a person's identity through a government lookup. How would you translate those groups into a person? It's a woman who's pregnant, 20-30, in Belfast. Now what?
      - Y-bar 2y ago
        Why are you seemingly arguing that the only personally identifiable bits of information are those with a strict 1:1 relation to an individual? And what are you trying to understand exactly? > About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person. https://dataprivacylab.org/projects/identifiability/index.html https://dataprivacylab.org/projects/identifiability/index.ht... Another US example: > Mr. X lives in ZIP code 02138 and was born July 31, 1945. These facts about him were included in an anonymized medical record released to the public. Sounds like Mr. X is pretty anonymous, right? https://www.eff.org/deeplinks/2009/09/what-information-personally-identifiable https://www.eff.org/deeplinks/2009/09/what-information-perso...
RamblingCTO 2y ago
For me it's in english: https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-0 https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-...
hnbad 2y ago
> If I have an ID in a cookie that links to these groupings, it is not necessarily the same as a GDPR breach. I guess this may be unintuitive if you're used to "letter of the law" interpretations but the GDPR is very much a "spirit of the law" directive. You don't get around its requirements with technicalities, especially not in combination with the ePrivacy directive which further fleshes out some of the implementation specifics for cookies and such (e.g. your consent modal needs to give equal weight to "reject all" and "accept all" if it does not emphasize the former and the former must be a one-click option not hidden behind a second dialog step). The type of data mentioned in the part you cited enjoys special protection in the GDPR so you better have a watertight justification for collecting and processing that data. To be clear: - Assigning a unique ID to a user across requests is GDPR-relevant (i.e. you likely require consent) - Associating that ID with demographic segments like those mentioned in TFA is GDPR-relevant (i.e. you likely require consent for tracking that data even if you infer it) It doesn't matter whether you explicitly collect demographic data or infer it based on behavioral data you collect. There's no way to "privacy-wash" this data. All the rights defined in the GDPR still apply to that data. If you want "clean" demographic data, you need to generate it without using any data originating from the user and you can not tie it to the user in any way (such as with an ID). So your testing environment using `faker` to generate test customer data is safe. Any production environment is not. I keep saying this but it's best to consider all forms of PII radioactive: you want to avoid it if possible, you need special containment procedures to handle it and you need to audit where any of it came from and where it went until you destroy it.

Y-bar 2y ago

I think Article 4, section 1 answers your question with regards to online identifiers such as cookies: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

robertlagrant 2y ago
I don't think it fits the bill. If I tell you I have a cookie with ID jeeg274642, how are you going to identify me? That's different to thing like a Twitter handle that can be traced straight to a person, as some can.
- Y-bar 2y ago
  Because I know where jeeg274642 belongs in the set of [gender, nationality_and_region, age_group, pregnancy_status, ...]. Just like a Social Security Number, a cookie (or whatever storage tech is used) need not contain the exact data of the individual, it only need to reference or be precise enough it for it to be a means of identifying them.
  - robertlagrant 2y ago
    Okay, but what do you actually do to identify? A social security number is a 1:1 to a person, if I understand them correctly. It's a direct ID number which lots of relatively low-paid, bribeable people can translate into a person's identity through a government lookup. How would you translate those groups into a person? It's a woman who's pregnant, 20-30, in Belfast. Now what?
    - Y-bar 2y ago
      Why are you seemingly arguing that the only personally identifiable bits of information are those with a strict 1:1 relation to an individual? And what are you trying to understand exactly? > About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person. https://dataprivacylab.org/projects/identifiability/index.html https://dataprivacylab.org/projects/identifiability/index.ht... Another US example: > Mr. X lives in ZIP code 02138 and was born July 31, 1945. These facts about him were included in an anonymized medical record released to the public. Sounds like Mr. X is pretty anonymous, right? https://www.eff.org/deeplinks/2009/09/what-information-personally-identifiable https://www.eff.org/deeplinks/2009/09/what-information-perso...

RamblingCTO 2y ago

For me it's in english: https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-0 https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-...

hnbad 2y ago

> If I have an ID in a cookie that links to these groupings, it is not necessarily the same as a GDPR breach. I guess this may be unintuitive if you're used to "letter of the law" interpretations but the GDPR is very much a "spirit of the law" directive. You don't get around its requirements with technicalities, especially not in combination with the ePrivacy directive which further fleshes out some of the implementation specifics for cookies and such (e.g. your consent modal needs to give equal weight to "reject all" and "accept all" if it does not emphasize the former and the former must be a one-click option not hidden behind a second dialog step). The type of data mentioned in the part you cited enjoys special protection in the GDPR so you better have a watertight justification for collecting and processing that data. To be clear: - Assigning a unique ID to a user across requests is GDPR-relevant (i.e. you likely require consent) - Associating that ID with demographic segments like those mentioned in TFA is GDPR-relevant (i.e. you likely require consent for tracking that data even if you infer it) It doesn't matter whether you explicitly collect demographic data or infer it based on behavioral data you collect. There's no way to "privacy-wash" this data. All the rights defined in the GDPR still apply to that data. If you want "clean" demographic data, you need to generate it without using any data originating from the user and you can not tie it to the user in any way (such as with an ID). So your testing environment using `faker` to generate test customer data is safe. Any production environment is not. I keep saying this but it's best to consider all forms of PII radioactive: you want to avoid it if possible, you need special containment procedures to handle it and you need to audit where any of it came from and where it went until you destroy it.