Is "No data for that individual" personal information?

Question

There are services that on presentation of identifying personal information (PI) provide further personal information. These include government data sources, credit reference agencies and fraud prevention services.

In the case when these services hold PI about the data subject and produce a response based on that I assume this would be personal information, and GDPR Article 14 would apply to the receiving data controller.

In the case when these services do not hold PI about the data subject, and produce a response based on that, perhaps something like "No Data" or NULL, is that itself personal information such that Art. 14 applies?

Take for example Cifas which holds multiple databases, approximately victims and perpetrators of fraud. They allow financial organisations to submit PI and receive information if the data subject has perpetrated a fraud or applied for protective registration. In the case an individual is in their databases and details are shared, this seems clearly a data transfer under the GDPR, and Art. 14 would apply. The majority of such requests are likely to come back negative, as most people are neither fraudsters nor registered victims. In this case the financial organisation knows something it did not before, but it is only "negative information". Is the fact that in individual is not on any Cifas database Personal Information?

Answer 1

Yes, at the moment that you submit the request to check what information they hold, they are processing personal data. The relevant definitions are at Article 4(1) and 4(2):

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note that personal data includes "any information" relating to an identified or identifiable person. The fact that you, a named individual, do not appear on a fraud database, is information relating to an identified person. Hence, it is personal data.

Note also that processing has a very wide definition; "any operation" which is performed on personal data.

Before you send the request to Cifas, they know nothing about you and have never interacted with you or your personal data, so the GDPR is not applicable. When you make the request, the following processing of personal data takes place:

• Transmission of the details which will be used for the check (e.g. name, date of birth, address).
• Recording / storing of those details in the server's memory while it performs the check.
• Use of those details when it checks for a match in the database.
• Transmission to you of the fact that nothing was found.
• (optional) Storage of copies of any communication by which they notified you that nothing was found.