Probably should be "salted hashes might be considered PII". It has not be tried by the EU court and the law is not 100% clear. It might be. It might not be.
Correct. This is a flawed hashing implementation as it allows for re-identification.
Having that IP and user timezone you can generate the same hash and trace back the user. This is hardly anonymous hashing.
Wide Angle Analytics adds daily, transient salt to each IP hash which is never logged thus generating a truly anonymous hash that prevents reidentification.
You can estimate the actual numbers based on the collision rate.
Analytics is not about absolute accuracy, it's about measuring differences; things like which pages are most popular, did traffic grow when you ran a PR campaign etc.
> ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
This does not reference hashing, which can be an irreversible and destructive operation. As such, it can remove the “relating” part - i.e. you’ll no longer be able to use the information to relate it to an identifiable natural person.
In this context, if I define a hashing function that e.g. sums all ip address octets, what then?
The linked article talks about identification numbers that can be used to link a person. I am not a lawyer but the article specifically refers to one person.
By that logic, if the hash you generate cannot be linked to exactly one, specific person/request - you’re in the clear. I think ;)
If the data gets stored in this way (hash of IP[0]) for a long time I'm with you. But if you only store the data for 24 hours it might still count as temporary storage and should be "anonymized" enough.
IMO (and I'm not a lawyer): if you store ip+site for 24 hours and after that only store "region" (maybe country or state) and site this should be GDPR compliant.
The GDPR is very clear here (https://gdpr-info.eu/art-4-gdpr/). So you must have misunderstood the lawyers you talked to or you are referring about a hash that cannot identify a person. If information can be linked to a person it is considered PII of that person.
No bad intentions with the title, was just using "banned" since Valve used it in their response to the Reddit poster. Change it to whatever you think is better! :)
Valve is quite clear about their reasoning. Since AI models use all kind of sources for their training, they don't want those assets on their platform because they are afraid of copyright claims.
For all we know, the game in question had images clearly aping some licensed characters. We don't know how stringent the policies are without clarification or examples of art found infringing. How did Valve know that the art was AI-generated? Did the developer tell them or include it in their marketing materials? It's basically just reading tea leaves without that information.
It actually sounds like if you claim to have ownership of the training data you can still use AI generated assets. For most people this is a distinction without a difference however.
