Thread · 6 tweets · 23 Apr 2021

No, the fact that it maps to a group doesn't change its personal data nature. To say that I have property "sexy" or that I'm a member in the set of sexy people says the same thing (in this ontology). But there are fun GDPR questions in there, and I guess it's Friday so... 😀

One is that it doesn't say "sexy" but rather 17. Is that meaningful? Well, you can act on it, so yes: it passes the performative test. Is it anonymised? Well, can someone reasonably break the indirection? Someone can, so it isn't.

You say it's not consented, but in Google's current implementation it relies on consented processing to protect special categories from being identified. Is that consent reasonably informed commensurate with the extent of the processing, its risk, and Art 9 aspects?

I would say that's at least a risk position, especially since Google has indicated that they don't believe similar consent to be sufficient for milder processing. The expectation might be that the DPC won't do anything, which is probably a smart bet.

One extra fun difficulty: with the special categories part of FLoC, Google have more or less made a public DPIA. This means other implementers can't ignore those risks, but they don't have the data to implement similar protections... This severely reduces the odds of a standard.

Anyway, interesting times and all that 😂