Re: Linkability & European reality

Lee,

without any prejudice to the discussion here:

The German Federal Data Protection Act (BDSG) includes a definition of 
"anonymisation" and "pseudonymisation"

BDSG Section 3

Paragraph 6: “Rendering anonymous” shall mean the alteration of personal 
data so that information concerning personal or material circumstances 
cannot be attributed to an identified or identifiable natural person or 
that such attribution would require a
disproportionate amount of time, expense and effort.

Paragraph 6a “Aliasing” (in the original German text it is explicitly 
called "Pseudonymisation") shall mean replacing the data subject’s name 
and other identifying features with another identifier in order to make 
it impossible or extremely difficult to identify the data subject.

http://www.bfdi.bund.de/EN/DataProtectionActs/Artikel/BDSG_idFv01092009.pdf?__blob=publicationFile 
This is a translation the German federal DPA provided.

I do not think that these definitions are entirely helpful in our context.

Ninja

Am 23.10.2012 18:12, schrieb Lee Tien:
> Kimon,
>
> Thanks for the pointer to the German Telemedia Law.  According to Google Translate, 15.3 says:
>
> "(3) The service provider may for the purposes of advertising, market research or for tailoring the Telemedia create user profiles using pseudonyms, provided that the user does not object. The service provider must inform the users of his right under the disclosure according to § 13 para 1. These user profiles can not be combined with information about the pseudonym."
>
> I was wondering if there is a statutory definition of "pseudonym," and what the last sentence means.
>
> Thanks,
> Lee
>
> On Oct 23, 2012, at 3:10 AM, Kimon Zorbas wrote:
>
>> Hi Walter,
>>
>> I am not aware any of my members using birth dates for display advertising in non-authenticated scenarios. Arguably, this constitutes personal data. I think it is good having such examples to approach business practices vs theoretically possible approaches.
>>
>> On ePrivacy transposition, you can find most legal texts adopted across the EU /EEA on our website, including a map, which shows the different approaches taken by the countries:
>> http://www.iabeurope.eu/knowledge-bank/knowledge-bank/public-affairs.aspx
>>
>>
>> For the German reference, check article 15.3 of the German Telemedia Law – that includes pseudonymisation.
>>
>>
>> Kind regards,
>> Kimon
>>
>> From: Walter van Holst <walter.van.holst@xs4all.nl>
>> Organization: COMECON
>> Date: Tuesday 23 October 2012 11:59
>> To: "public-tracking@w3.org" <public-tracking@w3.org>
>> Subject: Re: Linkability & European reality
>> Resent-From: <public-tracking@w3.org>
>> Resent-Date: Tuesday 23 October 2012 11:59
>>
>> On 2012-10-23 10:27, Kimon Zorbas wrote:
>>
>>> Many countries in Europe will accept many datasets as anonymous,
>>> whereas Germany takes (surprise, surprise…) a much stricter approach
>>> and only recognises such datasets as pseudonymous. In this context we
>>> cannot disregard pseudonymous data. Whether you can link such data
>>> and
>>> do so in practice (again, I believe theoretical debates are
>>> important,
>>> but what matters more to consumers and business is the actual
>>> practice, i.e. what 95% of companies do) is a question involved
>>> stakeholders might interpret differently. Striving towards a concept
>>> that takes a "strict US approach" on anonymisation (as I believe you
>>> suggest) would create a paradox with the strict data protection
>>> regulation in Germany…
>>
>> Dear Kimon,
>>
>> Given that the harmonisation achieved by the Data Protection Directive
>> is suboptimal to say the least, I am not going to doubt your assertion
>> that there is variation across European Data Protection Authorties'
>> opinions on what constitutes 'anonymous' data, despite all the guidance
>> provided by the Article 29 Working Group. Nonetheless it would be
>> helpful if you could provide some references for that assertion, if
>> necessary off-list.
>>
>>> entirely disregard. We want one global standard that can respond much
>>> better to privacy needs than blanket legislation.
>>
>> Given that the area of what is actually anonymous is governed by the
>> harsh reality of statistics and information theory (the examples Dan
>> gave are particularly enlightening in this regard), I think this should
>> be one of the subjects that should lend itself best for global
>> standardisation.
>>
>> This PhD dissertation deals with the subject:
>> http://cyberwar.nl/d/PhD-thesis_Measuring-and-Predicting-Anonymity_2012.pdf
>>
>> One of its conclusions was that 67% of Dutch citizens are identifiable
>> by their postal code and date of birth alone. I think this illustrates
>> the need for aggressive hashing.
>>
>> Regards,
>>
>>    Walter
>>
>>
>>
>
>
>

-- 

Ninja Marnau
mail: NMarnau@datenschutzzentrum.de - http://www.datenschutzzentrum.de
Telefon: +49 431/988-1285, Fax +49 431/988-1223
Unabhaengiges Landeszentrum fuer Datenschutz Schleswig-Holstein
Independent Centre for Privacy Protection Schleswig-Holstein

Received on Tuesday, 23 October 2012 16:32:19 UTC