Week 7: Google's Personally Identifiable Information
Each giant’s privacy policy, including Google, Inc. can recall data breaches within their timeline. Overall, it is all about how much you trust your service provider, and how deep you know to configure your own privacy. In this mobile computing era, we think we are getting closed to each other the most, actually, we are sacrificing our own privacy with or without consents. If you use specific features, they might also contain additional kinds of personally identifiable information (PII) (personally identifiable information (PII): Any information that can be used to identify a person, such as a name, address, e-mail address, government ID, IP address, or any unique identifier associated with PII in another program.), such as e-mail headers, send-for-review information, routing slips, printer paths, and file path information for publishing Web pages.
What Google does not want to happen is to have PII of the visitor to a website attached to behavior collected by Google Analytics of that visitor. Person 1 can search for Person 2 on a website. The fact that Person 2 was searched for is not a violation of Person 1’s privacy. But recording the real name of Person 1 and putting it together with the fact that they searched for Person 2, would be a violation of proper use of Google Analytics to record Person 1’s behavior. If you can tell who a person is by the information, by definition, that is indeed “personally identifiable information”. If there is only one person with that job title at a company, that is likely PII if the job title is for a specific time. However, if there are many people with that job title, it is likely not PII because you can’t narrow down to one person with the job title and company.
The distinction between sensitive and non-sensitive PII is helpful. Is it a generalization (e.g., all phone numbers are non-sensitive because they're found in phone books), or is it tailored to each person (e.g., the numbers included in phone books are non-sensitive, but unlisted numbers are sensitive). Google recently seems to be manually destroying PII information at their end without deleting accounts. Try not to pass any PII information via GTM filters which is a little more challenging but more effective.
The very best thing to do is to make sure that no PII data is sent to Google Analytics in the first place. However, filtering it out of the views is definitely smart to do as well (if for whatever reason you can’t prevent it being sent). And also true that Google is (manually) destroying PII information. But I am not 100% sure that will work in all cases since I have seen plenty of accounts that still contain this data. I hope that PII issues won’t occur anymore in the future. As long as it is not 100% done and confirmed, I still recommend companies to work on it by themselves. Your solution – not pass any PII information via GTM filters – might work as well.
Comments
Post a Comment