In other words, if you refer to someone with a specific job title at a specific organisation, there may only be one person who fits that description. However, in many instances, these pieces of information could be used together to narrow down the number of natural, living persons to such an extent that you could reasonably establish someone’s identity.
Get expert guidance on meeting your GDPR compliance requirements with IT Governance’s DPO as a service. Similarly, an organisation might ask what company they work for, which, again, couldn’t be used to identify someone unless they were the only employee.
This doesn’t fall under the GDPR’s scope of personal data, because, in all likelihood, a job title isn’t unique to one person. Organisations usually collect many different types of information on people, and even if one piece of data doesn’t individuate someone, it could become relevant alongside other information.įor example, a data controller that requests information on people who download products from their website might ask them to state their occupation. The qualifier ‘certain circumstances’ is worth highlighting, because whether information is considered personal data often comes down to the context in which it is collected. In certain circumstances, someone’s IP address, hair colour, job or political opinions could be considered personal data. The GDPR further clarifies that information is considered personal data whenever an individual can be identified, directly or indirectly, “by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” In other words, personal data is defined as any information that is clearly about a particular person. It is up to organisations to correctly interpret the GDPR’s definition:Įrsonal data’ means any information relating to an identified or identifiable natural person (‘data subject’)
The issue is that the Regulation doesn’t provide a definitive list of what is or isn’t personal data. Yet, we can understand why organisations continue to struggle with this aspect of the GDPR – particularly if they don’t have a dedicated data protection professional on their books. That’s a concern, because if organisations don’t meet their compliance requirements, they risk data breaches and disciplinary action. However, many organisations are still unsure exactly what ‘personal data’ is. Personal data is at the heart of the GDPR (General Data Protection Regulation).
0 kommentar(er)
