0

I would like to know whether a route between two physical places A and B, with its different step by step streets, can be considered as a personal data and should be processed as it. We don't know whether the user is going to type a direction with number or just the street name, for example, and the intermediary streets we will provide are just composed by street name and city. We are not able to know whether the user is typing its home or workplace.

Thanks.

  • Only if you can identify user by their route. – Greendrake Jan 24 at 22:23
  • @Greendrake We store the routes a user saves, but since there can exists two different users with same route, I'm not sure if they are personal data. – BigKangu Jan 24 at 22:44
  • 1
    Then when only one user exists with a route it is personal data. Otherwise not. – Greendrake Jan 24 at 23:51
-1

'Personal Data' means any information relating to an identified or identifiable natural person ('data subject')

The route is "any information". If it is "relating to an identified or identifiable natural person ('data subject')" then it is Personal Data, if it doesn't, it isn't.

You say in your comment "We store the routes a user saves" - if you store enough information about that user to identify a natural person (like a username, a real name, an IP address etc. or a combination of data [including the routes they store]) then the route is part of that Data Subject's Personal Data.

In almost all cases you will be storing enough data to identify a natural person - they only time you wouldn't is if the 'user' was not a natural person (e.g. a corporation or a group of natural persons) and you didn't store data that would allow the actual natural persons who were making the inquiries to be identified. In this case, its not the route data that's 'Personal' its the fact that the person requested that route.

'Personal Data' is not necessarily personal - it is data that is linked to a person. The actual contents of the data may have nothing to do with the person: its the link that makes it 'Personal Data'. It doesn't matter if the data can identify the Data Subject (e.g the weather in Sydney can't identify anyone) but the linking of that data to a (or more than one) Data Subject makes it 'Personal Data'.

  • The catch here is that the same piece of data (e.g. route) may be linked to more than one user, in which case it's not possible to identify just one. – Greendrake Jan 25 at 3:04
  • @Greendrake "We store the routes a user saves" - there may be a one-to-many relationship between routes and users (and good database design suggests that's how it would be stored) but the fact you can go from user to data means that it is 'Personal Data' - the contents of the data or the fact that you can't go the other way is irrelevant. – Dale M Jan 25 at 3:08
  • You need to be able to go from data to user to consider it personal, not from user to data. In case of one-to-many there are many users you can go to from data, hence user is not identifiable. – Greendrake Jan 25 at 3:32
  • @Greendrake its not the route that makes it personal, its the fact the user requested that route that does. – Dale M Jan 25 at 3:37
  • @Greendrake to clarify - if the date table that held the routes was leaked that would not be a data breach. However, if the table that linked the users to the route table as well was leaked, that would be a data breach. – Dale M Jan 25 at 3:49
0

Thinking about personal data becomes a bit easier when you start thinking of it as biographical data: information about an identifiable person.

Does the data in question tell a story about a person (that I can identify or may be able to identify if I tried)?

I need to fill out some detail to help you out...

For example, once you know that:

  1. I looked at/considered taking/searched for a route on (say) my phone, the data is personal data.

  2. I walked that route (or parts of it) at a particular time of day or date, it is personal data.

Also, if you store the route information that I queried ("type a direction with number or just the street name"), and associate it with me it's personal data (about me).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.