No, I mean all data, not just PII. If a Nest measures the temperature in my house I want to own those data points.

It's often data about you, in which case it's linked to you in which case it falls under GDPR. This crash data is definitely about you, as general driving data would be. Your home's temperature won't be, so GDPR indeed won't apply there, but GDPR is a good first step. (I mean, EU already had it since 1995, but in USA it would be a good first step.)

I agree that your proposal would be a good extension. Or at least that it should be the default, and you'd need to sign for being okay with not owning the data. Or that those devices contain warning stickers.

If the nest information is tied to your address (which is clearly personal), doesn't that make it personal information?

If they can retrieve whose house it was, then yes. But if they send it to the mothership and aggregate or anonymize it, then not. For example if they show you your house's temperature history, I assume it falls under GDPR because it's tied to your account so it's included with data about you.

Then, and I'm being serious: don't put a Nest in your house. You know what these things are, and you know what the company who makes them does.

Nest shouldn't have any rights to that data any more than Microsoft should have rights to novels written in Word.

I don't have a Nest, but it becomes increasingly difficult to buy things that don't produce data. I think we should adapt our laws before everything you can buy is "smart".

I get your point but I think arguing information about the state of your home is PII would be fairly straightforward.

Then pick any non-PII data point you like.

That doesn't really work because if it isn't PII, then they don't know who it belongs to (not having even your name is a field, or else it would be PII) and can't verify it belongs to you before giving it to you.

Like visiting websites while not logged into anything in generating tons of data, but it can't be easily linked back to you.

It would be possible to link some of it back to session IDs or other things you could be linked back to your device, but that doesn't show it was you using the device, so they may be releasing data belonging to someone else using your device to you. And that is before we get into possibilities like cookie hijacking or other methods of falsely tying your device to that generated data.

You're bringing up a separate argument. One worth having, but not in this thread.

The argument here is that the company knows who the data belongs to, and the person above is saying that they shouldn't be able to abstract "you" away from the data and claim it as their own property.. especially because, as we know, most anonymization techniques have serious flaws that in fact do allow individuals to be identified after close scrutinization.

The temperature of your house at certain times can be used to figure out when you were at home, what rooms you were in, when you went to bed, if you're just at home alone, or someone else was at home when you were there too.

Sounds like PII!