0

Imagine a UK-based company made an application to order food from restaurants. The company decided to share the following information with the restaurants to summarize orders made

  • restaurant location
  • food type
  • user age
  • user gender
  • time and date of order

I believe this information is not personal because we can not know the user's identity from only this information, is this correct?

1
  • This is a regulatory question (GDPR). As such, I'm migrating.
    – schroeder
    Nov 16, 2018 at 19:24

3 Answers 3

2

TLDR: you must seek legal advice.

Since you've stated that this is relating to a UK company, it will fall under GDPR as interpreted by the Information Commissioner's Office (ICO).

I suggest you read their guidance on this thoroughly: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/

And if you're feeling so inclined, you can read the full regulation here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN

DISCLAIMER: I'm wary of quoting parts of these pages here as it's possible they could change, check for the most updated information and take sound legal advice!

A couple of key parts of the legislation here are:

It's definition of personal data:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

And (emphasis mine):

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

So if you think that the data available would be sufficiently difficult to attribute back to an individual, then it would be considered anonymous information. If however, you think it is possible via any means reasonably likely to be used, to identify an individual with this data, then it is only pseudonymised and should be considered personal data.

For example... consider if is it possible, that the owners of one of the restaurants could take the information given and ask a delivery guy something like: "hey do you remember the order you delivered a month ago? They ordered some X and would have been a man about 30 years old?"

The only real advice anybody should give here is this - you must seek professional legal advice on the matter.

Good luck!

2
  • While this is true, its worth noting that the ICO have promised to work with people who have acted in good faith rather than throwing the book at them. So even if this does turn out to be personal data, the worst case is likely that you have to revise your business processes. Nov 16, 2018 at 21:17
  • This is a great answer, and illustrates some of the silliness of these GDPR laws. What actually would be useful is regulations to ensure that people who have such innocuous types of data can't use them to harm others. E.g. you shouldn't be able to open a bank or credit account with just a person's name and address. It does appear that financial institutions are requiring much better authentication now, which to me makes much of the GDPR pointless red tape. We already have good privacy plugins in our browsers. /Rant Oct 19 at 18:35
1

No, this is not personal information.

This is not considered personal information because it does not relate to something specific only to the user. Even if the user could somehow be identified based on the data provided by the company, it still would not be considered personal. This becomes a legal question, due to the fact that if we allow people to determine what's "personal" to them, the definition of what is "personal" becomes extremely subjective. The legal definition for your area and the one in the dictionary will probably be different.

To further answer your question, all 8 billion of us have an age, gender and food preference; only you live at your address(with the exception of family), use your social security number, and present your driver's license when pulled over.

2
  • I agree, but to elaborate, GDPR defines PPI as information that could be used either by itself or in conjunction with public records to determine your exact identity. Even in a small town, chances are you are not the only 42 year old man close enough to a Papa John's to be ordering pizza. Now if someone had that 42 year old's bank account access, they could cross reference the times and determine his identity, but that does not count since bank records are not "public records"
    – Nosajimiki
    Nov 16, 2018 at 20:39
  • @Nosajimiki I don't agree with your comment. The GDPR does not require data to be public, but just to be accessible. For example, a bank account number is not public. However there are situations where I can go to court to get the identity of the owner of the bank account from the bank. Only if it is forbidden by law to hand over data, it would not be accessible. So I would agree that a Swiss bank account number is not personal information because of the banking secrecy laws, but a bank account number from most other European countries is personal information.
    – wimh
    Nov 18, 2018 at 16:02
1

Given the time and date of the order, and the food type, it might well be possible for the restaurant to determine the specific order. Then if the customer paid with a credit card, it would be possible to connect to exact identification of the customer. Or it might be done via a delivery address.

So I do not think one can be confident or complacent that this application does not involve personal information. I agree that specific legal advice from someone with GDPR knowledge should be sought.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .