Honestly didn’t even realize it was “ok” for companies to share emails with third parties as I thought that is even considered PII.
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly.
The keyword here is indirectly.
Australia: https://www.legislation.gov.au/Details/C2019C00025
personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
(a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not.
The keyword here "reasonably identifiable".
So if the purpose of an email hash is to identify me for ads targeting, then it is by definition reasonably identifying me, even if indirectly.
> Hashing is magic crypto pixie-dust, which takes personally identifiable information and makes it incomprehensible to the marketing department. When a marketing person looks at random letters and numbers they have no idea what it means. They can't imagine that anybody could possibly understand the information, reverse the hash, correlate the hashes, track them, save them, record them.
[1] https://projectbullrun.org/surveillance/2015/video-2015.html...
What makes email address and other unique identifiers like a hash of an email PII is that the given universally unique composition of letters and symbols is associated with a person.
john.doe@example.com -> a facebook profile -> Legal Person
836f82d......b39577f -> a facebook profile -> legal person.
For identifying a person both 836f82d......b39577f and john.doe@example.com are the same.