[zelphirkalt]

> That something could potentially be correlated across time and space to link different facts about you, does not or should not make those things personally identifying.

I think the rules are usually though, that when those correlating things are put together, into one system, then the combination of those things are in sum personally identifying. That can actually happen very quickly and in non-obvious ways. You might add something inconspicuous and suddenly that makes users unique and allows to map in any theoretical way to real identities.

I think one also has to consider publicly available information sources. Just to make a silly example:

If there was some public register of favorite foods of people, and you asked your users about favorite foods, which you store in your database. Ooops, it is personally identifying, because anyone with that data in hand could map it to identities using publicly available data.

However, I am not so sure, that the publicly available data is considered for judging whether something is personally identifying information.

[origin_path]

But, you can't map to "identities" in most of these cases. That's why these laws don't seem to make any sense. An identity is a powerful thing but, an IP address is not an identity. Just knowing one doesn't tell you anything, nor does it let you look anything up unless you happen to have multiple sites that the user is browsing - and even then, not really, due to IP address re-use.

[zelphirkalt]

The conversation was about correlations and not merely about one attribute like IP addresses.

An IP address limits the location of a person significantly, unless they use VPN or so, which most people do not, so it cannot be assumed, but rather one must assume, that they do not use VPN.

Add one more attribute and through correlation you might already be able to map to an actual identity. It can happen very easily and you don't want to be an organization, which suddenly realizes, that some of their data has accidentally become personally identifying, when the next data protection audit happens.

Data also does not stay in one place only. It travels from department to department, often from organization to organization even. It has these tendencies, unfortunately. Each actor might have some data as non personally identifying, but when they sell and combine, suddenly it becomes personally identifying data.

An IP address is a very critical part in the data about users and ISPs are not to be trusted to never give their data to another actor. Many ISPs are shady businesses.