Re:My Data Request: Request your data from over 100 companies
by dangold on Sunday June 17, 2018 @11:08AM
(#17332667)
It concerns me that the site providing information about privacy policies, data subject rights, and privacy laws has a privacy policy that doesn’t even comply with the law. The policy states that they collect “non-identifiable information... which is collected passively using various technologies.” But that’s an incorrect statement of law. Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Also missing a lot of other stuff...
[ Parent
| on HN ]
Re:My Data Request: Request your data from over 100 companies
by usr1106 on Sunday June 17, 2018 @12:00PM
(#17332911)
> Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws.
Your argument is at least formally wrong, the GDPR does not contain any such concept as personally identifiable information. It covers personal data.
An IP address can be personal data under some circumstances.
IANAL, but I would be more than surprised if the interpretation of personally identifiable information and personal data ends up to be identical in legal practice. I'd assume that even lawyers are not sure yet, because there isn't any practice yet.
Re:My Data Request: Request your data from over 100 companies
by dangold on Sunday June 17, 2018 @12:42PM
(#17333094)
I used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.