3

According to Article 2(1) GDPR:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

In my country, Poland, we have a national identification number called PESEL. It has 11 digits which encode date of birth, sex, ordinal number and one checksum digit. All combinations can be easily generated on todays computers.

Article 87 GDPR states that:

Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation.

if I generate all 1,826,210,000 PESEL number combinations, do I become the holder of the personal database of all Polish people and (if I am a company) do the obligations arising from the GDPR begin to apply to me?

  • 1
    How will you determine which of those possible numbers actually correspond to natural persons? And even if you do happen to generate number X that happens to correspond to some natural person, how would you determine to which person that number corresponds? – Brandin Jan 24 at 14:01
  • @Brandin, in Poland, the PESEL number itself is widely considered to be personal data. This is confirmed by judgments of the courts and statements of the offices dealing with the protection of personal data. How it is in your country? Do you have national identification number? – Grzegorz Adam Kowalski Jan 24 at 14:37
  • 1
    If there are 1.8 billion possible PESEL numbers, then it is not possible that all of them correspond to actual natural persons. It would be like if I said person 12345678901 (supposing that is valid). It is just a number I made up; even if it turns out that there is actually someone corresponding to that identifier, it doesn't mean that I somehow have generated someone's personal information. You still need some way to link each number back to real persons. – Brandin Jan 24 at 14:44
  • There is a lot of controversy about that. The media every now and again report that access to the PESEL register is provided to various organizations - including private companies. They can read a lot of information about citizens and apparently this is not properly monitored. – Grzegorz Adam Kowalski Jan 24 at 14:46
  • Besides, just today in the Polish media there was a news about a woman who was generating PESEL numbers and taking loans from the banks on that basis. She stole a huge sum of money in this way. She has been caught and now has over 600 charges on her. gazetawroclawska.pl/… – Grzegorz Adam Kowalski Jan 24 at 14:48
3

Generating a list of all possible numbers doesn't sound like it would constitute personal data any more than listing all dates for the last hundred years as a "possible date of birth" would.

However, the moment anyone linked even one of the numbers with any other personal data - for example a name - they would be bound by GDPR and would need to show a Lawful Basis for processing the data.

[If you linked your own name you could presumably argue Consent, but anyone else's would need to have an associated Lawful Basis.]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.