Modern Pricing interprets PII as information that could be used on its own to directly identify or contact an individual. PII is never used to calculate a Modern Pricing score. This includes:
Modern Pricing interprets PII to exclude, for example:
IP addresses by themselves—or combined with other non-PII data—do not give the controller of the IP address the ability to precisely identify an individual. Our position stands with more than a decade of legal precedent in U.S. and European courts. Example case:
2009 - Johnson v. Microsoft - United States District Court, W.D. Washington
"[In] order for 'personally identifiable information' to be personally identifiable, it must identify a person. But an IP address identifies a computer."
The GDPR is a law passed in 2016 by the European Union that guarantees its citizens fundamental rights and freedoms to data collection and processing. GDPR permits lawful processing of data without explicit consent for “legitimate interests” of a controller:
2016 - General Data Protection Regulation (GDPR) - European Parliament
The legitimate interests of a controller, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller...The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.
We believe that determining fair pricing is a business critical objective that benefits customers and business alike, and by consequence constitutes a legitimate interest. Please see our Legitimate Interests Assessment for further information.