1

In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify people when put together - so they become personal data. Should the company that processed this non-personal data treat them as personal data? Do companies, on the basis of law, need to analyze the possibility of personal data being generated from non-personal data processed in it?

  • 2
    I think you're misunderstanding the definition of non-personal data. If you can combine 2 non-personal data to personal at least one of the "non-personal" data falls under the definition of personal data. – Swizzler Feb 19 at 15:52
2

Non-Personal data defines that that can't be traced to certain people/entities.

By that definition it doesn't matters how much non-personal data you accumulate, you won't be able to create personal data from it.

Do companies, on the basis of law, need to analyze the possibility of personal data being generated from non-personal data processed in it?

No, since non-personal data cannot be made personal without adding new personal information. I strongly recommend to analyze if the currently collected "non-personal" data truly fulfills the definition of "non-personal" data.

This document can help:

http://www.europarl.europa.eu/RegData/etudes/BRIE/2018/618988/IPOL_BRI(2018)618988_EN.pdf

  • The document you linked states that personal data can be made from non-personal data, eg. "Recent advances in processing massive amounts of data using novel analytical techniques will tend to make this grey area expand, as more personal data is mined from non-personal data records. That mining of nonpersonal data can be used to build identifiable personal profiles." – Grzegorz Adam Kowalski Feb 19 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.