When No One Is Just a Face in the Crowd

First, my original comment was simply meant to point out the feasibility of the practice. The fact that Nomi says they choose not to collect "personally identifiable information" doesn't mean that someone else couldn't (using the same technique) if they wanted to.

But frankly, I don't really trust the term "personally identifiable information" unless it is qualified, because it can mean very different things to different people in different contexts[0]. For example, for one service (I believe the DNS servers) Google claims to "anonymize" IP addresses, but it turns out that they only obscure the last two or three digits, which isn't enough to conceal the identity of the individual.

For another example, you wouldn't believe some of the things that are considered protected health information when dealing with patients (ie, for HIPAA/HITECH compliance)[1].

Even if I trust a company's intentions (which I don't unless given a strong reason otherwise), trusting (a) their ability to understand what information is and isn't sensitive; and (b) guard that information both require a bit more than a vaguely worded assertion on their website.

If you collect information about where a person (or "device") has been over time, that in itself can be an incredibly identifying piece of information - all you need is one other datapoint to "lift the veil", and suddenly you know a lot of sensitive information about a particular individual.

[0] IANAL. "PII" is a legal term, and whether or not certain pieces of information qualify as PII can (and has) been litigated, so the line is ambiguous enough that a simple promise not to collect PII does little to assuage my privacy concerns.

[1] Likewise, you wouldn't believe some of the things that aren't (necessarily) considered PHI.

PII is generally considered something that is unique and non-public information like a Social Security Number. A broadcast address like a MAC or an IMSI is not private and unless it was combined with a name would not be considered PII.

So as a retailer/third party I could correlate an IMSI/IMEI with an item that was purchased and still be in the clear so long as I do not tie the purchaser's name to it.

How often you visit the store, where you walk in the store, how long you are at the store.

Your identity doesn't need to be attached for this information to be useful; for example, the store can say things like "gee look half our customers leave three minutes after they enter the store, so we are having a hard time converting walk-ins to sales". Or perhaps "Wow it looks like 90% of our customers come back within a week, we are doing great at getting repeat visits"

Yeah, it's pretty rare that someone is outright banned from a store. I've only ever personally heard of it in the context of a private grocer and a many-times-repeat offender.

They can already get your mobile records during a court ordered investigation. That information includes where you were and who you were with. Or rather where your phone was and who your phone was with.

Indeed. I was rather shocked to hear a friend had be subpoenaed for a DNA swab based on phone tracking data, along with a handful of other men, in connection with a rape case that happened early in the morning (so few phones in the area). The idea was two-fold a) rule out suspects, and b) (presumably) get in touch with potential witnesses. While everyone wants the guilty party to get caught, I'm unsure what options one would have about refusing such a swab. In theory that swab wouldn't be held on file (but who can know if there is a secret backup of such data -- we don't have adequate oversight in Norway either).