If so, another fantastic example of expensive and complex regulation being gamed by the big players while the smaller entities are left with the cost.
It was essentially tracking everyone who passed it by characteristics like gender, if they had glasses, where they were looking.
But yeah, every person was just an entry. There was no way for it to know who that person was.
I wish I could find the story but my google-fu isn't helping.
Such a billboard in a small town up north in Norway could easily identify the individuals based on those characteristics since the population is so low.
People's privacy usually isn't impacted until datasets are combined, compromising pseudonimity.
However, for any smaller player wishing to compete on the advertising side the cost of entry is now humongous because of intense up-front cost to setup capability that is in compliance.
Et voila, corporations win in the end.
So what you're really saying is that a detailed dataset is more valuable, and shouldn't be considered anonymized. Or, more succinctly, "anonymized" should not be boolean, but is a quantitative property of the dataset.
Sex == 1 bit. Hair color =~ 2 bits. Glasses/no glasses =~ 0.6 bits. Phone number == 33 bits. Location to 1km precision would be many more bits in a rural area (less people / lower density) than in a big city. And so on.
This would take care of the metadata. It would also put the companies on the defensive - if _the company_ thinks they're collecting just 20bits of data, but if I can do some fancy ML on their data (require regular external audits of collected data if more than say 10k people were tracked) and retrieve 27bits, that would put them in breach (& massive penalties).
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... Chapter 1 Article 4, definition of personal data
[...] an identifiable natural person is one who can be identified, directly or indirectly [...] or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
If I read this correct, if you can be identified by a tuple (sex,hair color, classes, more attributes), the GDPR applies, even if they have no name etc... Hence, even an anonymized ID is still identification for the GDPR.