4 ms·

I think Article 4, section 1 answers your question with regards to online identifiers such as cookies: > ‘personal data’ means any information relating to an i

by Y-bar 2y ago

I think Article 4, section 1 answers your question with regards to online identifiers such as cookies: > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/

robertlagrant 2y ago
I don't think it fits the bill. If I tell you I have a cookie with ID jeeg274642, how are you going to identify me? That's different to thing like a Twitter handle that can be traced straight to a person, as some can.
- Y-bar 2y ago
  Because I know where jeeg274642 belongs in the set of [gender, nationality_and_region, age_group, pregnancy_status, ...]. Just like a Social Security Number, a cookie (or whatever storage tech is used) need not contain the exact data of the individual, it only need to reference or be precise enough it for it to be a means of identifying them.
  - robertlagrant 2y ago
    Okay, but what do you actually do to identify? A social security number is a 1:1 to a person, if I understand them correctly. It's a direct ID number which lots of relatively low-paid, bribeable people can translate into a person's identity through a government lookup. How would you translate those groups into a person? It's a woman who's pregnant, 20-30, in Belfast. Now what?
    - Y-bar 2y ago
      Why are you seemingly arguing that the only personally identifiable bits of information are those with a strict 1:1 relation to an individual? And what are you trying to understand exactly? > About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person. https://dataprivacylab.org/projects/identifiability/index.html https://dataprivacylab.org/projects/identifiability/index.ht... Another US example: > Mr. X lives in ZIP code 02138 and was born July 31, 1945. These facts about him were included in an anonymized medical record released to the public. Sounds like Mr. X is pretty anonymous, right? https://www.eff.org/deeplinks/2009/09/what-information-personally-identifiable https://www.eff.org/deeplinks/2009/09/what-information-perso...

by Y-bar 2y ago

robertlagrant 2y ago

I don't think it fits the bill. If I tell you I have a cookie with ID jeeg274642, how are you going to identify me? That's different to thing like a Twitter handle that can be traced straight to a person, as some can.

Y-bar 2y ago
Because I know where jeeg274642 belongs in the set of [gender, nationality_and_region, age_group, pregnancy_status, ...]. Just like a Social Security Number, a cookie (or whatever storage tech is used) need not contain the exact data of the individual, it only need to reference or be precise enough it for it to be a means of identifying them.
- robertlagrant 2y ago
  Okay, but what do you actually do to identify? A social security number is a 1:1 to a person, if I understand them correctly. It's a direct ID number which lots of relatively low-paid, bribeable people can translate into a person's identity through a government lookup. How would you translate those groups into a person? It's a woman who's pregnant, 20-30, in Belfast. Now what?
  - Y-bar 2y ago
    Why are you seemingly arguing that the only personally identifiable bits of information are those with a strict 1:1 relation to an individual? And what are you trying to understand exactly? > About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person. https://dataprivacylab.org/projects/identifiability/index.html https://dataprivacylab.org/projects/identifiability/index.ht... Another US example: > Mr. X lives in ZIP code 02138 and was born July 31, 1945. These facts about him were included in an anonymized medical record released to the public. Sounds like Mr. X is pretty anonymous, right? https://www.eff.org/deeplinks/2009/09/what-information-personally-identifiable https://www.eff.org/deeplinks/2009/09/what-information-perso...