6

As a follow up question from this question a person's name, age, address, parties affiliation are considered public data.

I'd like to ask then what is considered personal information?

So if there is a website breach of data i.e. on Facebook and the hackers get the information mentioned above, Facebook doesn't need to worry because this data is not considered personal information?

Note: Since this is state specific then what most of states agree on what is personal information.

5
  • 1
    The state have differing laws on this. Which did you have in mind?
    – Trish
    Apr 27, 2022 at 19:26
  • @Trish, well, I guess I would need to ask another question why some states consider something to be personal and not the other. In this case, I would like to know what most of states agree on what is personal information...
    – Grasper
    Apr 27, 2022 at 19:28
  • 1
    I'm adding the Ohio tag, since that's where you implied you live.
    – Ron Trunk
    Apr 27, 2022 at 19:41
  • 2
    @Grasper Questions about why the law is as it is are mostly off-topi on this site, they can be asked on Politics.SE. Here one may ask what the law is, and how it differs from place to place or situation to situation. Apr 27, 2022 at 20:06
  • 1
    @Grasper "Why" is usually easily answerable with "the lawmaker said so". In some cases the process is evaluateable, for example by reading the Federalist Papers to understand Hamilton and the Founding Fathers
    – Trish
    Apr 28, 2022 at 7:32

2 Answers 2

7

"Personal information" is not really the right concern, although some laws may use that expression (or similar expression like "individually identifiable health information"). Rather than trying to reduce the matter to an arbitrary and legally undefined category of "personal information", it would be more informative to inquire about information that can or cannot be legally disclosed.

First, there are statutory prohibitions – laws that prevent certain people from disclosing specific information without your consent. There are such law applying to health and educational records or financial information, which limit what information a health care provider can disclose – I'm not a health care provider, so I can legally disclose information about you that your doctor can't disclose. The flip side is that many states also have a legal requirement to publish personal information including home address of sex offenders.

Facebook has established a privacy policy which is part of their terms of service: it says what they can and cannot disclose about you. AFAIK they have no idea what your home address is, but that policy will tel you if they can disclose your address. If they don't grant themselves permission to disseminate your address yet they do so, they have to worry that you will sue them for breach of contract. If a hacker gets your information from their databases, they have a different worry, namely whether they will get sued for negligence. They disclaim liability: they

DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT

to the extent allowed by law. At worst, they would owe you $100 for "letting" a hacker get your home address (which they don't have, anyhow), or your email address (which they do have). The negative consequences for Facebook come not from the fact of information being disclosed, but from the fact of blatant and repeated violation of their own policy, which the FTC deemed to be deceptive.

7

Federal and state laws do protect a variety of different types of personal information in particular contexts, but there isn't really any information that is necessarily personal and protected from disclosure in all contexts.

For instance, the Health Insurance Portability and Accountability Act generally protects a person's health records from unnecessary disclosure, and the Federal Education Rights and Privacy Act generally protects a student's educational records from unneccessary disclosure.

But that doesn't mean that all of an American's health information is protected, or that all of the information that a hospital holds about an American is protected. The hospital can typically disclose the fact that it is treating a specific person, and if that person provides his health records to a government employer, that employer may be required to produce them in response to a request under the Ohio Public Records Act.

But Facebook isn't a health-care provider, so it isn't required to protect medical records, and it isn't a school, so it isn't required to protect educational records. At the federal level, I don't know of any privacy laws that require it to maintain the privacy of its users' information, though it may be required to do so under state laws, or as a contractual matter because of its privacy policy.

But that doesn't mean it has nothing to worry about. Like any business in the United States, it is prohibited from engaging in deceptive trade practices, so it can't make broad promises to protect users' privacy when it has no intention of honoring them. That's why it ended up paying $5 billion for privacy violations in the past and remains under court orders requiring it to better protect users' data.

Further, Facebook has users all over the world, so it is required to comply with the international privacy regulations like GDPR that can be far more stringent.

5
  • On the last point, Facebook only has to comply with those regulations when dealing with users to whom those regulations apply (for example, the GDPR only applies to Facebook’s handling of personal information of EU citizens). In general, this means that they don’t comply with those regulations when they do not have to, because complying with them is more expensive than not doing so. Apr 28, 2022 at 11:46
  • 1
    Is the GDPR based on citizenship or location? How do they know I'm not an EU citizen if I log in from France? How do they know that I am an EU citizen if I log in from Turkey?
    – CGCampbell
    Apr 28, 2022 at 13:22
  • Complying with stricter regulations is generally more expensive than not doing so, but if a company needs to comply with respect to some users, then it may be cheaper (not to mention safer) to comply for all users than to treat different users's data differently. Apr 28, 2022 at 14:48
  • @CGCampbell: Not a lawyer, but am a software engineer. My understanding of GDPR is that it generally applies to data that is collected while the subject is physically located inside the European Union, but not to data collected from subjects outside the EU, regardless of citizenship, and also only to companies that market to a European audience.
    – moonman239
    Apr 28, 2022 at 16:04
  • @CGCampbell so in that case, it's possible that GDPR would protect data that's collected from you while you're in France, but not data that's collected from you while you're in TUrkey.
    – moonman239
    Apr 28, 2022 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .