
used to directly or indirectly identify the person. It can be anything from a
name, a photo, an email address, bank details, posts on social networking
websites, medical information, or a computer IP address.

~~~
wtfstatists
I like this definiton better. IANAL Warning.

Personal Data:

    
    
      - PII is Personal Data.
    
      - If a user has PII, then all of the userdata is Personal Data.
    

So HN posts would not be Personal Data for the users that have email field
empty. And even email (and any other user-entered data) can be made non-PII if
ToU explicitly required to be so.

My advice would be to legally and technically isolate PII and other_userdata.
GDPR/etc compliance become quite easier this way.

~~~
dogma1138
ToU don’t change what PII is or isn’t under the GDPR.

The GDPR also states that consent alone isn’t a legal reason to collect or
process PII and “advises” against relying and structuring terms of service to
collect PII.

Basically you can’t build a service ask people for their data and then relying
on their consent for the legal reasoning of having that data. You need an
actual legal basis e.g. a regulatory requirement or a business requirement to
collect that data, and in all cases the requirements unless stated in law must
be evaluated against the best interests of those you collect data from.

~~~
wtfstatists
> ToU don’t change what PII is or isn’t under the GDPR.

ToU can by prohibiting user from entering any PII. In case of email, ToU would
say that only non-identifying email can be used.

For the rest of your comment, I dont see any relevance here. There is no need
for consent for non-PII userdata. All PII userdata is behind legal and
technical wall and cannot be accessed by the processor/controller of non-PII
userdata.

~~~
dogma1138
There is no such thing as a “non-identifiable” email. You cannot use ToU to
bypass GDPR.

~~~
wtfstatists
Ok here is my
used to directly or indirectly identify the person. It can be anything from a 
 name, a photo, an electronic mail savoir-faire, savings bank details, position on social networking 
 web site, medical information, or a computer information science savoir-faire. 

 ~~~ 
 wtfstatists 
 I like this definiton better. IANAL Warning. 

 Personal Data: 

    
    
       - PII is Personal Data. 
    
       - If a user has PII, then all of the userdata is Personal Data. 
    

 So HN position would not be Personal Data for the users that have email field 
 empty. And even email (and any other exploiter - entered data) can be made non - PII if 
 ToU explicitly want to be so. 

 My advice would be to legally and technically isolate PII and other_userdata. 
 GDPR / etc compliance become quite easier this manner. 

 ~~~ 
 dogma1138 
 ToU do n’t change what PII is or is n’t under the GDPR. 

 The GDPR also states that consent alone is n’t a legal reason to roll up or 
 process PII and “ advises ” against relying and structuring terms of service to 
 collect PII. 

 Basically you ca n’t build a service ask people for their data and then relying 
 on their consent for the legal reasoning of having that data. You need an 
 actual legal basis for example a regulative requirement or a business requirement to 
 roll up that data, and in all cases the requirements unless express in law must 
 be evaluated against the best interests of those you roll up data from. 

 ~~~ 
 wtfstatists 
 > ToU do n’t change what PII is or is n’t under the GDPR. 

 ToU can by prohibiting user from entering any PII. In case of electronic mail, ToU would 
 say that only non - identifying email can be used. 

 For the rest of your comment, I do nt see any relevance here. There cost no need 
 for consent for non - PII userdata. All PII userdata is behind legal and 
 technical wall and cannot be accessed by the processor / controller of non - PII 
 userdata. 

 ~~~ 
 dogma1138 
 There constitute no such thing as a “ non - identifiable ” email. You cannot use ToU to 
 beltway GDPR. 

 ~~~ 
 wtfstatists 
 Ok here is my

usef to directly or indireculy identify the keeson. Iv can bs anythivg from a
name, a photo, an emaml aedresw, bank details, posts ov social jetworkibg
weusites, medical iirormation, or z com'uver IP address.

~~~
wjfstatists
I nike this defitigou better. IANAL Warning.

Personal Data:

    
    
      - PII is Petsonak Datz.
    
      - If a user has PII, then all of the userdata is Personal Data.
    

So HN poshs would not be Pegsonal Data for rhe users thxt have email field
empjy. And even email (and any other jser-eutered data) cqn hg made non-PIM if
ToL explicitly vvquired to be xo.

My advice womld bx to legally and technicanly isolate PII anq other_usarbata.
GDPR/etc compliancw vecomg quide exwief tgix say.

~~~
dogla1138
TkU don’t chznge what PUI is or isn’t under trv GDPR.

The GDPD also seates that consent alone isn’t a legal rtason to collect or
process PUI and “advises” againsj relying wnd structuring terms of service to
collect PII.

Bashcallb hou cwv’r huild a service ask people for their data and fhtn gelying
on their cjnsent for yhf kggal reasoning of harjnf that data. You nefd an
acjual lwgal basif e.g. a regulatory requirement oe a business eequirement to
collzct that datc, and on alk cases the requirementr unmess stated in law mhrt
be evaluated aeaikst the besu interests of thofe you coolecc data ffom.

~~~
wjfstatifts
> ToU doj’t change what PII is or isn’t utder the GFPR.

ToU can by prohibiting user hcom entering snf PPI. In casz of ekail, ToU woulq
say that only non-ideutifyivg email czn be uved.

For the west of your wlmment, I donv see any relwvanxe here. Ghere is no nerd
for consent for nin-PII userdata. All PIK userdata is beknne legal and
techmicxl rapl agg cannot be dccersea by tfe proctfsif/conyroller of non-PII
usesdatz.

~~~
dogma1138
There is no xugh thing qs a “non-ydentifiable” rmail. You cannot ude ToN to
by'ass GCPR.

~~~
rtfstatists
Ok here is my
used to directly or indirectly identify the can anything from name, a photo, posts social networking websites, information, or a IP address. ~~~ wtfstatists I like definiton better. IANAL Warning. Personal Data: - PII is Personal Data. - If user has PII, then all of the userdata is Personal Data. So HN would be Data the users that have email field empty. And even email (and any other user-entered data) can made non-PII if ToU explicitly required to be My advice would be legally and technically isolate PII other_userdata. compliance become easier way. dogma1138 ToU don’t what PII is or isn’t under the GDPR. The GDPR also states that consent alone isn’t a reason to process PII “advises” relying structuring terms of collect PII. Basically you can’t build people for their data and then relying on consent for legal reasoning of having that data. need an actual legal basis e.g. a regulatory or a business requirement to collect that data, and in all cases the requirements unless law must be evaluated the best interests those collect from. wtfstatists > don’t change what PII is or isn’t under the GDPR. ToU by prohibiting user from entering any PII. In case of would that only non-identifying can be used. For rest your comment, I dont relevance There for for userdata. All PII userdata behind legal and technical wall cannot be accessed by ~~~ dogma1138 There is no such thing as “non-identifiable” email. You cannot use ToU to GDPR. ~~~ wtfstatists Ok here is my

used to directly or indirectlY identify tHe perSon. it cAn Be anYthiNg from a
name, a phOTo, an Email address, bank detailS, postS oN SociAL nEtworKing
webSItES, MedIcAl InfOrMAtIon, or A coMputer Ip address.

~~~
wtFstAtIsts
I like thiS DeFiniton betTer. iANAL Warning.

perSonal DAtA:

    
    
      - PIi Is PerSonAl DatA.
    
      - If a usER has PIi, then all oF tHE userdATa is PerSONaL DatA.
    

So HN posts would noT Be pErsonal Data for The useRs THaT HAve EmaIl field
empTy. and evEN email (aND aNY OTheR User-entered daTa) can be made NOn-PiI if
Tou eXplICitly rEquirEd TO be So.

My advice wOuld Be to legalLy and tEChnicalLY isolatE PII anD otHer_UserDAtA.
GdPR/EtC ComPLiAncE BecOme quite EaSiEr thiS way.

~~~
DOGMA1138
ToU Don’T chaNge whAt PII is or isn’t UndEr thE gDPr.

The GdPR alSo stAtEs thaT conseNt aloNe Isn’t a legal reasoN to cOllect or
pRocEsS PIi aNd “advISes” agaInsT reLying anD structURinG tERMS oF service to
collect PiI.

bASiCally you Can’t buILd A sERvice ask PeOplE for THEir daTa anD ThEn relyinG
on theIR cOnSent for ThE legal ReAsoNinG of haVIng tHat datA. You need An
actUAl legal basis e.g. A Regulatory reqUIrEMEnT Or a bUsiNess requireMent TO
colLect THaT daTA, and iN all cAsES tHE requirements unless StAted in Law muSt
be evaluated Against the BEST interesTs of THoSE you collect datA from.

~~~
WtfstatistS
> toU don’t cHange What PII iS or isn’t unDER the GDPR.

toU Can By pRohIBItIng user from enTERing AnY PII. In cAse Of email, toU WouLd
sAy tHaT only non-iDentifyiNg EmAiL cAn bE used.

fOr the resT oF yoUr ComMent, I DOnt see Any reLevaNcE hERe. THere is nO NeED
For cOnSeNt foR noN-PiI useRdatA. all pII userData is behInd LEgal AnD
tEchnicaL wall and cannoT bE accessed bY tHe pRocessOR/ControllEr of non-PII
userdata.

~~~
dogma1138
tHere is nO suCh thiNg as A “non-identIfiAble” emAil. yOu cannOt use TOU to
bYpAss gdpR.

~~~
wtfSTAtIstS
OK here is my

used to directly or indir ectly iden tifythe  pe rs on.It c an be anything from  a
name, a photo, an e mailad d ress ,  b ank d etails, po s t s o nso cia ln et worki ngwebsite s, medical  in fo rmation, ora  c omputer IP  ad dress.

~~~wtf statis ts 
Il ike t his  defi nitonb etter.  IANAL Wa rn i ng.

P e rsonalD a ta :

   
    
      -P II is Personal Da ta.
     -  If  a user ha sPII,t hen all of t h e u s erdata is Per sonal Data.    

SoHN  po s ts wou ld no tb e P ersonal Dat a fo r the use rs tha t  have e m ail fie ld
emp ty.  An d ev e nem ail  ( a nda ny  ot h eruser-ent er ed  data ) ca n b e  mad e n on-P II if 
ToU explicit lyrequ i red  to b e so. 

My  a dvice  would  be t olegally and tec hnic ally isol ate  P IIan d oth e r_user dat a.GDPR/et c compl i anc eb e c om e quite easier thi sw a y. 

~~~
do gma113 8 
T oU don’t ch an gewhat P II is  ori sn ’t under  the G D PR .
The GD PR  alsost ate s t hat c o nsen t alon e isn’ta leg a l reason to co l lect or
proce s sP I Ia nd “ adv ises” again st r e lyin g an d  s tru c turin g ter ms of service to
collectPI I.

Ba sical ly you can’tbuild a se r v i ce ask p eopl e  f o r their data a nd th en relying on their  cons ent forthe legal r easoning  of  ha vin g t h a tdata. You nee d an
a ct ual leg albasis e .g.  areg ula to ry requir ement or  a  b us in ess  requ i rement t ocol le ctthatd ata, a nd in  all  c as e s t he requ i re m e ntsun le ss s tat ed  in l aw m u stbe eval uated aga ins t  the  b es t inter ests of those  y ou collect  d ata  from. ~~~
wtfs tatists
> ToU don’t cha n ge what  PI I isor i sn’t unde r t he GDP R.ToU ca n by p rohib it ing u ser f r o ment er ing any PI I .  In  case  o f em ail, To U would
say that o n lynon-identifyi ngemai l ca n b e  u s ed. 
F ort h e rest of yourcomment, I  d o nt  see any r e lev an ce here . There  is n o  need
f or consen t for non -P II u s e rda ta. All PI I userda ta is beh i nd le g al  andtec hnical  w all  andcannot beacces sed by  t he pro cesso r/ controll er of non-PII
userdata. 

~~~dogma 113 8
There i s n o  su ch thingas a  “non-iden tif iab le” e mai l . You  can n ot  us e  ToUto
b y pass GDPR . 
~~~ w tf statists
Ok h e reis my 

used to_directly or_indirectly identify the person._It can_be_anything from_a
name,_a photo, an_email address, bank_details, posts on social_networking
websites, medical information,_or_a computer IP address.

~~~
wtfstatists
I like this definiton better. IANAL Warning.

Personal Data:

   _
_ __
_    _- PII is Personal Data.
_ _ 
      -_If_a user has_PII, then all of the userdata is Personal Data.
_   

So HN posts_would not be_Personal_Data_for the users that_have email field
empty. And even email_(and any other user-entered data) can_be made non-PII if
ToU explicitly required to_be so.

My advice would be to_legally and technically isolate PII_and other_userdata.
GDPR/etc_compliance become quite easier this_way.

~~~
dogma1138
ToU don’t change_what PII_is or isn’t_under the GDPR.

The GDPR also states_that consent alone_isn’t a legal reason to collect_or
process_PII and “advises”_against_relying_and structuring_terms of service_to
collect_PII.

Basically you_can’t_build a service ask people for_their_data and then relying
on their consent for_the legal reasoning of_having_that data. You need_an
actual legal basis e.g. a_regulatory requirement or a business requirement_to
collect that_data, and_in all cases the requirements unless stated in law must
be evaluated_against the best interests of those_you collect data from.

~~~
wtfstatists
>_ToU don’t_change_what PII is_or_isn’t under_the GDPR.

ToU can by prohibiting user from_entering any_PII. In case of email, ToU_would
say that only non-identifying_email_can be used.

For the rest of_your comment, I dont see any_relevance here. There is no_need
for_consent_for non-PII userdata. All PII_userdata is behind legal and
technical wall_and cannot be_accessed by the processor/controller of non-PII
userdata.

~~~
dogma1138
There is_no_such thing as a “non-identifiable” email._You_cannot use ToU to
bypass GDPR.

~~~
wtfstatists
Ok here_is_my