[te_chris]

I'm pretty sure GDPR is meant to force disclosure of derived data too.

[mehrdadn]

Are you sure? I didn't find a clear sentence on this last time I looked. It seems hard to define what is derived data (if they guess that a 20 year old is a student, is that derived data? or just a guess) and I can imagine it leaking information about other people if it involved aggregating together pieces of data from multiple people.

[icebraining]

The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person". So as long as this derived data is directly related to a person, the GDPR applies.

More explicitly, the UK's regulator says: "You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request."

[mehrdadn]

Huh, thanks for that. So e.g. LinkedIn not providing any information on (say) emails they've scraped seems blatantly illegal too?

[jenscow]

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

[jsty]

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

[isostatic]

What if you don't store the inference, but instead process it when needed internally in a function?

  if (dob.month == december) $birthstone = quartz
  select advert from adverts where stone = $birthstone

Or whatever

[icebraining]

For ads, you probably don't need to tell people about the "birthstone". But if that automatic processing "produces legal effects concerning him or her or similarly significantly affects him or her" (such as denying a credit card or job offer), then you have to give the person "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for [them]."

[tyfon]

GDPR requires that you log when you use information from a user in models, reports etc so this would probably have to be logged and disclosed.

You would also need explicit concent to use the date of birth for advertising purposes.