Behavioral Derived Categorization

[RobertKeyser]

For user.derived.identifiable data categories, there seems to be two types of categories: those that the user is and those that the user does.

• For example biometric_health, demographic, contact, gender, location, non_specific_age, race, religious_belief, sexual_orientation, organization, and workplace describe something about the user.
• On the other hand, browsing_history, media_consumption, observed, profiling, search_history, social, telemetry, user_sensor describe things that the user has done or does, their behavior.

These don't have to nested exactly like that, but it would be helpful to have a hierarchical category to represent the user's behavior, which might be treated differently from things a company has learned about the user.

One might imagine a case where a company would want to set a policy to prevent capturing any behavior-based identifiers, but allow generally derived information as part of the app's use.