News for hackers. Stuff that matters.
Re:Migrating from Google Analytics by chrisseaton on Thursday January 03, 2019 @12:13AM (#18812969)
Are the events not enough to re-identify the user? Not having a name literally in the database doesn’t make it anonymous.
Re:Migrating from Google Analytics by dorgo on Thursday January 03, 2019 @04:25AM (#18813864)
As long as events don't have name/email/ip/... there should be no problem as far as i understand it. The regulation targets only personal identifiable information.
Re:Migrating from Google Analytics by icebraining on Thursday January 03, 2019 @04:56AM (#18814007)
PII is a concept is US law. The GDPR uses personal data, defined as:

"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"

Pseudonymization (separating unique identifiers from the rest of the datapoints) can and should be used as a safeguard, but doesn't remove the need to protect the data, particularly if you keep a link between the two.

Re:Migrating from Google Analytics by chrisseaton on Thursday January 03, 2019 @09:06AM (#18815144)
If you were a bookshop and your events log someone anonymous as buying a book on niche topics A, B and C, I reckon that could easily globally uniquely identify me as there aren't many people in the world interested in all three. Then you could also see me buying a book on embarrassing topic D and blackmail me with it. No personal identifying information, but it's not anonymous.
Re:Migrating from Google Analytics by mywittyname on Thursday January 03, 2019 @10:20AM (#18815694)
Finger-printing is not PII. And the people blackmailing you because you're interested in both finger painting and the orficial applications of pine cones would not be entirely sure it was you. If they had an email address, name, or IP address with a timestamp, then they could be quite certain it that it was you.
Re:Migrating from Google Analytics by chrisseaton on Thursday January 03, 2019 @11:34AM (#18816365)
> Finger-printing is not PII

I didn’t say it was. The original conversation wasn’t about PII it was about anonymising. Fingerprints defeat anonymisation.

I reckon in practice with for example an Amazon sales log with names removed and my public Twitter feed you could de-anonymise me with a high degree of certainty.

Re:Migrating from Google Analytics by georgewfraser on Thursday January 03, 2019 @04:31AM (#18813892)
No argument from me, there are things like IPs that are very hard to find every copy of and eliminate. Putting the users in their own table is just a simple best-practice that has a lot of benefits, so it’s a great first step.