You can say it is protected.
You can say it takes effort to link to an individual person.
But databases of contact data connected to device IDs, such as that in the UK NHSX app, are *unambiguously* not anonymous data under UK law.
You can say it takes effort to link to an individual person.
But databases of contact data connected to device IDs, such as that in the UK NHSX app, are *unambiguously* not anonymous data under UK law.
It was said such data are anonymous in the press briefing yesterday.
Unless you redefine the word for your conversation to not relate to UK law — which as that government you should not do — this is an untruth.
Unless you redefine the word for your conversation to not relate to UK law — which as that government you should not do — this is an untruth.
It is not a legal grey area. It quite literally is explicitly clarified in UK law that device identifiers are personal data. This clarification isn’t even needed to come to the conclusion above — the law is so clear it is easily arguable without it.
In Breyer, the CJEU held that even *dynamic* IP addresses are personal data when held by the state. This case is even clearer: a static, persistent identifier.
This is not even new to the GDPR. @fborgesius writes in ‘Singling Out People without Knowing Their Names’ about how such data has always been legally non-anonymised for the history of modern data protection law (1998 in the UK). papers.ssrn.com/sol3/papers.cf…
