Hacker News Reader

Comment by tinus_hn | Hacker News Reader

The data includes the users IP address which is personal information. It is not anonymous.

Where does it say the IP address is stored with the data?

Recital 26 says:

> The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not OR NO LONGER identifiable. [emphasis mine]

So as long as the data becomes no longer identifiable, recital 26 seems to apply.

in their privacy policy. Section 1b.

The Usage Data that we collect may include information such as ...... Internet Protocol address ......

https://www.ui.com/legal/privacypolicy/

Fair enough. It does say "may". :) It's still possible for other data to be "anonymous" if it's stored independently of an IP address, device identifier, etc. since recital 26 allows for data that is "no longer identifiable".

The moment the device connects to Unifi, without your permission, they have your IP.

Then again, they had it when you downloaded the update, and when your devices check for auto update, so, you’re not getting away from this data collection with an opt out button.

"May" is synonymous with "will", as far as complying with privacy regulations is concerned.

in such case, it might be pseudonymous, but to make it pseudonymous specific effort is required. I'll copy an old comment which explains the terms. ID in this case could be the IP address, device identifier etc...

--------------------------

A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII.

the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2].

So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them.

[1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable

[2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.

Reply on news.ycombinator.com