2

We are a Canadian company outside Quebec with a minority of customers in that province. We are trying to tighten up our compliance with Quebec's Law 25 on Privacy. The law says:

Personal information is any information which relates to a natural person and directly or indirectly allows that person to be identified.

It's the word "indirectly" that I'm not clear on. Suppose you store information about a person that, on its own, could not identify them uniquely because there are too many people in your customer base or community matching those attributes. E.g:

{ Hair: "Brown", Eyes: "Blue", Height: "188cm" }

Now suppose there is a second set of information not stored by your organization but existing somewhere out in the world that could, if combined with the first set stored by your organization, uniquely identify the person. E.g:

{ Birthdate: "1980-01-01", Hospital: "Mercy General", Sex: "Male" }

Neither sets of data could uniquely identify a person currently living, but together they probably could, with a little digging. So is the first set of data considered personal if stored by an organization by itself?

My guess is, no. The information is only personal if they store both sets of data.

What do you think?

If the answer were yes, it could lead to ridiculous situations where you would need consent to record the tiniest bit of information about a person because, theoretically, it could be combined with a large amount of other information and uniquely identify someone. For example, even the timestamp of a single visit to a website could uniquely identify someone if combined with hundreds of other timestamps of visits by the same person. Effectively, this interpretation would make it impossible to store any personal information without consent, even the most obscure and innocuous information, because there would always be the possibility of combining multiple data sets to uniquely identify someone.

P.S. We are actually storing much more boring data, nothing nearly as sensitive as birthdate, sex, hospital, etc. This is just an example to try to make the question clear.

4
  • Such "anonymous" records are potentially linkable to other data sources. Latanya Sweeney's work around 2000 demonstrated this for similar public data sets, and introduced an early mathematical model to describe anonymization. Later research by Cynthia Dwork showed that even unlinkable data can have a privacy impact. However, the real solution to your conundrum is that this Quebecois law doesn't require consent for everything. You may need consent when collecting data from third parties or when using collected data for a different purpose.
    – amon
    Oct 19, 2023 at 19:54
  • Yes, seemingly anonymous personal information can potentially be linked to other data sources. That's why I asked this question. Does such data constitute personal information under Law 25? If so, a whole bunch of requirements apply, not just consent. But if not, then our life is much easier, and all we have to do is make sure it doesn't fall into the wrong hands. Oct 19, 2023 at 21:55
  • The premise of the question implies both databases using an identical set of identifiers somewhere to link the two entries. That likely would be personal data.
    – xngtng
    Oct 20, 2023 at 8:50
  • @xngtng In practice, probably, yes. But as Amon pointed out in the comment above, there are techniques for linking datasets using probabilistic/statistical matching, e.g. en.wikipedia.org/wiki/Latanya_Sweeney. Oct 20, 2023 at 17:00

1 Answer 1

0

Yes

At least, based on court interpretation of the GDPR

Personal information is any information which could, in conjunction with other data, theoretically identify a person, even if you don’t hold that data. For example, an IP address is personal information even though your organisation has no ability to link that IP address to a person: an ISP somewhere can.

However, I would be surprised if the Quebec law only allowed consent in order to comply. The GDPR allows 7 bases for collecting personal information.

9
  • Do you have links to judgements/articles supporting this? As I said, the reductio ad absurdum of this concept is that the smallest bit of data about a person, even a single timestamp of their last access to your site, could theoretically be combined with other data and be the "last piece of the puzzle" that identifies the person. Therefore at least section 9.1 would apply, and we must "provide the highest level of confidentiality by default." This could be interpreted to mean that if we don't really need timestamps, we can't collect them, because they might be personal information :-( Oct 20, 2023 at 16:42
  • 2
    Yes, if you don’t need time stamps, don’t collect them. If you do need it, provide the highest level of confidentiality. You’re starting to understand how to deal with personal information.
    – Dale M
    Oct 20, 2023 at 21:01
  • 1
    @JordanRieger the law is not particularly interested in how technically difficult it might be to comply. Just that you do.
    – Dale M
    Oct 21, 2023 at 1:04
  • 2
    “Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.” commission.europa.eu/law/law-topic/data-protection/reform/….
    – Dale M
    Oct 22, 2023 at 8:01
  • 1
    @JordanRieger I can see how it could be read that way, but the courts have chosen the interpretation that the personal information is the “different pieces”
    – Dale M
    Oct 24, 2023 at 7:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .