Hacker News Reader

Comment by Clubber | Hacker News Reader

When I was reading about the GDPR today, I read that email address and IP are considered private data as well. This means any website with an email login or subscription or that even logs hits with the request IP must take action.

I fully support protection against physical locations and personal information (name, address, etc), but to include email and IP address seems a little excessive.

View on HN

My email address and IP address ARE personally identifying. I am delighted that websites should protect this information.

I get and somewhat agree with your point, but on the flipside, excluding certain types of data means that companies will focus on abusing them to skirt regulations. I can see why they just went all-in on the types of data that are considered PII, because in different contexts, different data are possibly PII.

It's not a perfect solution, but I'm not sure there is one.

Friend works in data law and says that it's ambiguous. One of the problems is that people use personal information in their email. Also, you have no idea if it's actually personal information or just a nickname they've given themselves. For these reasons it looks unlikely that emails will be considered personally identifiable information.

That's unlikely to be true. And people are stupid, and will use their email address - just look at e.g. the Ashley Madison hack. So for most people, it's personal information, and the law will probably treat it as such.

Reply on news.ycombinator.com