dangold

I used a broad term to encompass laws of various jurisdictions, but my statement is correct. Personal data is any information relating to an identified or identifiable natural person. Thus, personal data by its definition includes PII. But not all personal data is PII. Personal data also includes other data such as pseudonymized data (such as hashed IDs). In any event, the company needs to revisit its privacy policy.

It concerns me that the site providing information about privacy policies, data subject rights, and privacy laws has a privacy policy that doesn’t even comply with the law. The policy states that they collect “non-identifiable information... which is collected passively using various technologies.” But that’s an incorrect statement of law. Information collected passively generally includes IP addresses, which falls within the definition of personally identifiable information under the GDPR and certain US privacy laws. Also missing a lot of other stuff...