Why server connection telemetry isn’t automatically personal data under the GDPR

Another adtech discussion showing that not all information gleaned through server connections is personal data under the GDPR (or even the CCPA’s broad “personal information” concept). [Nor is it / should it be automatically covered by ePrivacy rules]

In this case, it was about which data points are actually being used, by whom and who will be able to derive any insights from such data points.

Some lessons for everyone, even beyond the adtech / martech scene:

1. Better be safe than sorry: assume something is at least potentially personal data (so you can implement better controls anyway), but then don’t forget that you can challenge that assumption if the facts do not support it.

2. Challenge regulators where appropriate: regulators (such as the supervisory authorities on the EU data protection scene) are not infallible, and their position (or that of campaigners) may not always be legally correct. A few additional thoughts here:

– If you do, expect an uphill battle, so think carefully about documenting your technical and legal arguments.

– If you think a fight might not be worthwhile in the short term, beware the slippery slope. [We have seen this a number of times, notably in cases on cookies or on the role of the DPO and (in)compatibilities]

3. Context matters: consider national sensitivities and priorities, as your approach might work well in one jurisdiction but give rise to complaints in another.

4. Get the right support: in this case, some had shared a dogmatic and basic approach with a client initially, and did not look at or understand the technical aspects sufficiently. Make sure you are properly advised.

Think your approach might need to be strengthened, or better documented? Maybe you might also wish to reach out!