undefined | Better HN

0 pointste_chris7y ago0 comments

I'm pretty sure GDPR is meant to force disclosure of derived data too.

0 comments

Are you sure? I didn't find a clear sentence on this last time I looked. It seems hard to define what is derived data (if they guess that a 20 year old is a student, is that derived data? or just a guess) and I can imagine it leaking information about other people if it involved aggregating together pieces of data from multiple people.

icebraining7y ago

The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person". So as long as this derived data is directly related to a person, the GDPR applies.

More explicitly, the UK's regulator says: "You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request."

mehrdadn7y ago

Huh, thanks for that. So e.g. LinkedIn not providing any information on (say) emails they've scraped seems blatantly illegal too?

jenscow7y ago

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

jsty7y ago

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

isostatic7y ago

What if you don't store the inference, but instead process it when needed internally in a function?

  if (dob.month == december) $birthstone = quartz
  select advert from adverts where stone = $birthstone

Or whatever

2 more replies

j / k navigate · click thread line to collapse

0 comments

mehrdadn7y ago

icebraining7y ago

The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person". So as long as this derived data is directly related to a person, the GDPR applies.

mehrdadn7y ago

Huh, thanks for that. So e.g. LinkedIn not providing any information on (say) emails they've scraped seems blatantly illegal too?

jenscow7y ago

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

jsty7y ago

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

isostatic7y ago

What if you don't store the inference, but instead process it when needed internally in a function?

  if (dob.month == december) $birthstone = quartz
  select advert from adverts where stone = $birthstone

Or whatever

2 more replies

j / k navigate · click thread line to collapse