2

One of GDPR's main topics is processing data. Article 4 tells:

(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

From what I see, processing is related to such use which either modifies data or saves some kind of result elsewhere.

I have only performed a small personal data analysis without saving the conclusions or the logic in any form. Is it considered data processing?

Improve this question
1
  • 1
    So if I make a request over an http channel, you "process" the data and return it to me without every saving the processed data on your media, do you think that should be covered by the GDPR?
    – doneal24
    Commented Mar 27 at 16:07

2 Answers 2

Reset to default
2

Yes

This is covered by “consultation”.

For example, if you operate a bar and are required to verify a customer’s age, you might “consult” their ID. This requires compliance with the GDPR even though there is no written record.

Improve this answer
4
  • In your analogy of a barman "consulting" an ID document, is there actually any control of data in that situation? Certainly if records were made by the barman then those records would be covered by GDPR, but if he simply reads the document with his eyes (so as to reach a mental decision) and returns it to the owner, never storing the document nor making any other record about it, then the activity surely cannot be covered by GDPR.
    – Steve
    Commented Mar 27 at 5:33
  • @Steve the barman has “recorded” the data in the sense that for a while, depending on their memory, they could recited the name, address, and date of birth. If they disclose that to a third-party, that would be a data breach.
    – Dale M ♦
    Commented Mar 27 at 7:33
  • 2
    That's not a record 😂. I had to check that the GDPR hadn't changed something relative to the DPA 1998 (in the UK). The GDPR uses the concept of a "filing system", and covers only personal data which is or is intended to be part of a filing system. The interaction and transient cognitive storage you're describing is not processing that occurs within the scope of a filing system (as we know it). (1/2)
    – Steve
    Commented Mar 27 at 10:01
  • At best, the ID document itself may be a record within the scope of the state's filing system (which includes a decentralised element where the subject has an authentic record in their own possession), but I wonder whether the courts would tolerate this being analysed as a "consultation" of the state's filing system by the barman. (2/2)
    – Steve
    Commented Mar 27 at 10:01
3

Yes.

According to the definition, you did some "processing" if you performed "any operation or set of operations which is performed on personal data or on sets of personal data".

The definition does not say something to the effect of it only counts as processing if you saved the results or conclusion. It says processing is "any operation" and has a non-exhaustive ("such as") list of examples (including "saving" aka "storage").

How is "analysis" not covered by one or more of the non-exhaustive examples below?

  1. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

The UK's Information Commissioner's Office guidance says:

Processing means taking any action with someone’s personal data. This begins when a data controller starts making a record of information about someone, and continues until you no longer need the information and it’s been securely destroyed. If you hold information on someone, it counts as processing even if you don’t do anything else with it.

"Any action" seemingly used in place of "any operation".

And merely "hold[ing] information on someone ... counts as processing."

European Commission guidance says:

Examples of processing include:

...

  • access to/consultation of a contacts database containing personal data

Access to personal data is processing.

There would be a peculiar loophole if analysis of personal data is not processing given that merely storing personal data or accessing personal data is processing.

I'm not sure how analysis could be done without first "retrieving" (or accessing) the data; if it was retrieved, it was processed; or "used", if it was used, it was processed, and so on.

Improve this answer
3
  • 1
    "I'm not sure how analysis could be done without first "retrieving" the data" Streaming data. You'd be analysing it in real time as it's being generated and then eventually overwritten by new data.
    – nick012000
    Commented Mar 27 at 11:01
  • Another individual has made the data available (e.g. downloaded and saved, i.e. processed). My question was about my actions as an analyst who connects a modern tool to an already existing file, does a basic filtering and closes the tool without saving. Currently, it seems, even taking a look at the data is already considered processing.
    – ZygD
    Commented Mar 27 at 12:42
  • 1
    @ZygD My point is, it says "any operation". I am finding it difficult to imagine what analysis can be done without an operation. Opening it is an operation; reading it is an operation; filtering it is an operation.
    – Lag
    Commented Mar 27 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .