In a company, two isolated departments process data that is not personal data. After processing, the documents go to the trash. They are found there by someone and it turns out that they identify people when put together - so they become personal data. Should the company that processed this non-personal data treat them as personal data? Do companies, on the basis of law, need to analyze the possibility of personal data being generated from non-personal data processed in it?
asked Feb 19, 2019 at 15:46
-
2I think you're misunderstanding the definition of non-personal data. If you can combine 2 non-personal data to personal at least one of the "non-personal" data falls under the definition of personal data.– user9886Commented Feb 19, 2019 at 15:52
Add a comment
|
1 Answer
Non-Personal data defines that that can't be traced to certain people/entities.
By that definition it doesn't matters how much non-personal data you accumulate, you won't be able to create personal data from it.
Do companies, on the basis of law, need to analyze the possibility of personal data being generated from non-personal data processed in it?
No, since non-personal data cannot be made personal without adding new personal information. I strongly recommend to analyze if the currently collected "non-personal" data truly fulfills the definition of "non-personal" data.
This document can help:
http://www.europarl.europa.eu/RegData/etudes/BRIE/2018/618988/IPOL_BRI(2018)618988_EN.pdf
-
The document you linked states that personal data can be made from non-personal data, eg. "Recent advances in processing massive amounts of data using novel analytical techniques will tend to make this grey area expand, as more personal data is mined from non-personal data records. That mining of nonpersonal data can be used to build identifiable personal profiles." Commented Feb 19, 2019 at 22:16