6

As a developer of software intended for use by EU citizens, I am committed to complying with the personal data requirements of the forthcoming legislation (EU Regulation 2016/679).

There is a definiton in Article 4 (1):

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

In my opinion, the above definition is pretty wide and the directive texts are quite heavy. I would like to see a definition/list of examples of relevant personal data that software engineers and developers would find usable when developing software intended for use in the EU.

I hope this question is not regarded too wide. I consider it to be a practical problem and hope for great answers.

Improve this question
1
  • Are there particular kinds of data you find unclear? There is probably no good way to comprehensively list what would be covered.
    – ohwilleke
    May 31, 2017 at 0:51

3 Answers 3

Reset to default
7

The answer is right there in the quote:

any information relating to an identified or identifiable natural person

So if the data can in any way be tied to a specific individual then it is personal data. Note that you have to consider the data collection as a whole - even if there are no names in your data, if there is enough info in it that you can work out who the individual is (or probably is) its personal data.

Obvious things include names, dates of birth, physical addresses, electronic addresses, social media profiles etc. Less obvious things include job or profession, memberships of organisations, friends and associates, town/suburb etc. i.e. things that in combination can reduce the set of people it could be to a small number of individuals.

Basically, if you collect and store information about individuals in any way you are caught by this regulation. Even an email address used for login is personal data in that it identifies an individual and tells a hacker that they use your software.

Examples of what is not personal data includes information about judicial persons (companies and other organisations that are sufficiently large that individual information cannot be inferred) or properly anonomized data where the data set is sufficiently large that identifying any particular individual is highly improbable (several dozen people at least depending on how revealing the data is).

Improve this answer
1
  • 1
    Good answer. On top of that, please note the fact that Foreign Keys in database tables can be Personally Identifiable Information. To take a simplified example in the context of a webshop : a user_id FK from an ORDER_ITEM table to a USER table is PII, even if it just reads "3083882 (long)", since you can make the link back to the user. The chaining can be much longer ofcourse - usually the order_id would be tied to a basket, which would be tied to a user.
    – niilzon
    May 31, 2017 at 9:02
4

As a software developer, here's a model for thinking about it that may help you:

Can you make a valid Primary Key with some portion of that data?

No one field by itself, without other context, is likely to be PID (Personally Identifying Data) but be wary of the ability to infer context even if you don't specify the role of the data.

eg: if you just received the number 6 without even a label, it means little.

A number in the format of a phone number or US Social Security Number might be reasonably inferred as to its role and then is certainly PID.

In health data, there's been significant work on proving how data that was assumed to be anonymous is actually traceable to an individual because enough context allowed narrowing the scope.

So the bad news for you is that you have probably inadvertently made more data fall under the PID category than you realised. Does the combination of data you store make it personally identifying? If so, what is the smallest amount you could remove so that none of the rest could be combined to become a PID.

Improve this answer
3

With all due sympathy to your need, the citation you give is as much of a definition as there is, and there are no definitive or even reliable lists that distinguish "is personal" vs. "is not personal". This UK guidance based on the Data Protection Act 1998 seems to assume the same basic principles as to what it is, and may be useful as a semi-algorithmic way to make the determination. The main problem is that you will never get any examples of what is "safe", for instance nobody will say "However, if the subject is identified only as 'Tom', that is not personal data". Instead, any such guidance will re-state the rule and say "If this statement is true then it is; if not, it is not".

The key, though, is the ability to identify an individual. Information that the person "lives in Belgium" is not personal data because many people live in Belgium, but if you add enough other information ("emigrated in 1982, born in Kajo Keji") that could easily identify a specific person. An IP address may or may not be personal data; credit card numbers and email addresses would be. Following the UK model, even though an email address can only occasionally be used by typical people to identify an individual, they generally can be used by someone with the know-how.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.