2

But wait, it gets better: This full name belongs to person who was interviewed in an article under this URL.

https://support.google.com/analytics/answer/7686480?hl=en

What Google considers PII: ... full names or usernames

Now, probably the right question would be: Should common CMS's such as Wordpress censor names from URLs?

PS: This is a rather food for thought question, I do not expect you to provide a correct answer, I am more interested in your point of view on this specific use case.

2
  • Are you trying to say any harm here is WordPress's fault? I don't think it is responsible for how you configure it.
    – Rup
    Commented Dec 11, 2019 at 10:29
  • No, you have misread what I am asking. That's just additional food for thought.
    – dusoft
    Commented Dec 11, 2019 at 14:06

1 Answer 1

2

You are mixing your terms; GDPR talks about personal data:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

PII is more a US term, for which NIST says:

PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

Either way around, a name is clearly personal data. However, that just means it has to be processed appropriately. You can't sue Twitter because https://twitter.com/realdonaldtrump might identify a particular individual.

1
  • 1
    I am not mixing anything. Please, read my clearly stated question again. It is against GA's policy to store PII (or personal data) - in this case a full name. GDPR audits require you to analyze sources where personal data is stored. In this case it is GA (URL/page report).
    – dusoft
    Commented Dec 11, 2019 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .