undefined | Better HN

0 pointsunilynx7y ago0 comments

which clause would apply to require a DPO?

clause a: not a public body

clause b: not systematically monitoring (eg. installing video cameras all over the streets)

clause c: not processing large scale sensitive or criminal information.

doesn't look to me like a DPO is needed based on this article?

0 comments

It really comes down to the definition of "systematically monitoring". On our service we capture behavior (say in FullStory) and Google Analytics at a "large scale". How the DPO clause gets interpreted is going to be a key finding in the next few months. This is imho the most confusing and potentially difficult part of GDPR

arianvanp7y ago

Not that's irrelevant in this case. The question is whether you're processing sentive PII on a large scale. DPO is only necessary when processing sensitive PII. Sensitive is very clearly defined in the law as race, religion, medical records or biometric data. And IP addresses certainly do not qualify as sensitive PII (they are PII though) so I don't understand the entire discussion here. Seems to be just a political kneejerk

kaspm7y ago

That's fair in this case, at my company we track "pregnancy status" and "due date". It's unclear at this point whether that's considered sensitive PII.

zmmmmm7y ago

XMPP does have presence functionality so I'd consider that to be systematic monitoring. I don't know if his service is doing that, but it's one of the most useful aspects and definitely seems to fit the definition to me.

j / k navigate · click thread line to collapse

0 pointsunilynx7y ago0 comments

which clause would apply to require a DPO?

clause a: not a public body

clause b: not systematically monitoring (eg. installing video cameras all over the streets)

clause c: not processing large scale sensitive or criminal information.

doesn't look to me like a DPO is needed based on this article?

0 comments

kaspm7y ago

arianvanp7y ago

kaspm7y ago

That's fair in this case, at my company we track "pregnancy status" and "due date". It's unclear at this point whether that's considered sensitive PII.

zmmmmm7y ago

j / k navigate · click thread line to collapse