3

We are a Canadian company outside Quebec with a minority of customers in that province. We are trying to tighten up our compliance with Quebec's Law 25 on Privacy. The law says:

Personal information is any information which relates to a natural person and directly or indirectly allows that person to be identified.

It's the word "indirectly" that I'm not clear on. Suppose you store information about a person that, on its own, could not identify them uniquely because there are too many people in your customer base or community matching those attributes. E.g:

{ Hair: "Brown", Eyes: "Blue", Height: "188cm" }

Now suppose there is a second set of information not stored by your organization but existing somewhere out in the world that could, if combined with the first set stored by your organization, uniquely identify the person. E.g:

{ Birthdate: "1980-01-01", Hospital: "Mercy General", Sex: "Male" }

Neither sets of data could uniquely identify a person currently living, but together they probably could, with a little digging. So is the first set of data considered personal if stored by an organization by itself?

My guess is, no. The information is only personal if they store both sets of data.

What do you think?

If the answer were yes, it could lead to ridiculous situations where you would need consent to record the tiniest bit of information about a person because, theoretically, it could be combined with a large amount of other information and uniquely identify someone. For example, even the timestamp of a single visit to a website could uniquely identify someone if combined with hundreds of other timestamps of visits by the same person. Effectively, this interpretation would make it impossible to store any personal information without consent, even the most obscure and innocuous information, because there would always be the possibility of combining multiple data sets to uniquely identify someone.

P.S. We are actually storing much more boring data, nothing nearly as sensitive as birthdate, sex, hospital, etc. This is just an example to try to make the question clear.

4
  • 1
    Such "anonymous" records are potentially linkable to other data sources. Latanya Sweeney's work around 2000 demonstrated this for similar public data sets, and introduced an early mathematical model to describe anonymization. Later research by Cynthia Dwork showed that even unlinkable data can have a privacy impact. However, the real solution to your conundrum is that this Quebecois law doesn't require consent for everything. You may need consent when collecting data from third parties or when using collected data for a different purpose.
    – amon
    Commented Oct 19, 2023 at 19:54
  • 1
    Yes, seemingly anonymous personal information can potentially be linked to other data sources. That's why I asked this question. Does such data constitute personal information under Law 25? If so, a whole bunch of requirements apply, not just consent. But if not, then our life is much easier, and all we have to do is make sure it doesn't fall into the wrong hands. Commented Oct 19, 2023 at 21:55
  • The premise of the question implies both databases using an identical set of identifiers somewhere to link the two entries. That likely would be personal data.
    – xngtng
    Commented Oct 20, 2023 at 8:50
  • @xngtng In practice, probably, yes. But as Amon pointed out in the comment above, there are techniques for linking datasets using probabilistic/statistical matching, e.g. en.wikipedia.org/wiki/Latanya_Sweeney. Commented Oct 20, 2023 at 17:00

2 Answers 2

2

Revisiting this question to document my own research, I still believe the answer is "no."

If it were "yes", it would allow reductio ad absurdum where the smallest bit of data about a person, even a single digit of a single timestamp of their last access to your site, could theoretically be combined with other data not stored by the organization and be the "last piece of the puzzle" that identifies the person, and therefore each digit would have full privacy protection.

This article, from a GDPR perspective, outlines reasons why certain routine data collection, such as timestamps and IP addresses, do not require consent in all cases, provided they are handled and stored with care: https://www.termsfeed.com/blog/gdpr-log-data/. The article relies on the GDPR concept of "legitimate interest" to justify that.

Quebec Law 25 has a similar concept in section 12 which I believe would apply to many real-world cases that I envisioned when I asked this question. It says consent is not required to collect or use the information:

(3) if its use is necessary for the purpose of preventing and detecting fraud or of assessing and improving protection and security measures;

(4) if its use is necessary for the purpose of providing or delivering a product or providing a service requested by the person concerned;

(5) if its use is necessary for study or research purposes or for the production of statistics and if the information is de-identified.

There is also the concept of de-identified (anonymized) personal information:

For the purposes of this Act, personal information is (1) de-identified if it no longer allows the person concerned to be directly identified;

This doesn't specifically say whether information that is insufficient on its own to identify a person would be considered personal, but it does mean that such information doesn't have the same restrictions.

2
  • In GDPR: to process personal data you must have a lawful basis (there are six lawful bases); Art 4(1) "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly,..."; Recital 26 "... To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. .. "
    – Lag
    Commented May 1 at 11:02
  • @Lag that seems to support my interpretation, because it's not reasonable to expect the data to be combined with other data outside the organization, unless we allow it. Of course, that is only the GDPR and not Quebec's Law 25, but hopefully they are interpreted similarly. Commented May 2 at 13:29
1

Yes

At least, based on court interpretation of the GDPR

Personal information is any information which could, in conjunction with other data, theoretically identify a person, even if you don’t hold that data. For example, an IP address is personal information even though your organisation has no ability to link that IP address to a person: an ISP somewhere can.

However, I would be surprised if the Quebec law only allowed consent in order to comply. The GDPR allows 7 bases for collecting personal information.

9
  • 2
    Do you have links to judgements/articles supporting this? As I said, the reductio ad absurdum of this concept is that the smallest bit of data about a person, even a single timestamp of their last access to your site, could theoretically be combined with other data and be the "last piece of the puzzle" that identifies the person. Therefore at least section 9.1 would apply, and we must "provide the highest level of confidentiality by default." This could be interpreted to mean that if we don't really need timestamps, we can't collect them, because they might be personal information :-( Commented Oct 20, 2023 at 16:42
  • 2
    Yes, if you don’t need time stamps, don’t collect them. If you do need it, provide the highest level of confidentiality. You’re starting to understand how to deal with personal information.
    – Dale M
    Commented Oct 20, 2023 at 21:01
  • 1
    Not collecting timestamps is absurd. Imagine how deeply you would have to dig into dozens of software libraries you use to configure all of them not to log timestamps. I suppose we could just declare that "we need timestamps to maintain our services and troubleshoot issues."... Commented Oct 20, 2023 at 22:05
  • 1
    @JordanRieger the law is not particularly interested in how technically difficult it might be to comply. Just that you do.
    – Dale M
    Commented Oct 21, 2023 at 1:04
  • 2
    “Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.” commission.europa.eu/law/law-topic/data-protection/reform/….
    – Dale M
    Commented Oct 22, 2023 at 8:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .