In detail
- Does the data ‘relate to’ an identifiable data subject?
- Is the content about an individual?
- Does the purpose of the processing make information personal data?
- Does the data impact, or have the potential to impact, on an individual?
- Is data that refers to an identifiable individual, but does not relate to them, personal data?
- Is inaccurate information about an individual still personal data?
Does the data ‘relate to’ an identifiable data subject?
It will often be clear where data ‘relates to’ a particular individual. However, sometimes this is not so clear and it may be helpful to consider in more detail what ’relates to’ means.
Data which identifies an individual, even without a name associated with it, may be personal data if you are processing it to learn or record something about that individual, or where the processing has an impact on that individual. Therefore, data may ‘relate to’ an individual in several different ways, the most common of which are considered in this section.
Is the content about an individual?
Information may be obviously about a particular individual or about their activities. This information is personal data regardless of the purpose for which you are processing the data.
In many cases data may be personal data simply because its content is ‘obviously about’ an individual. Alternatively, data may be personal data because it is clearly ‘linked to’ an individual as it is about his or her activities and you are processing it for the purpose of determining or influencing the way in which that individual is treated. Data may also be personal data if it is biographically significant or has a particular individual as the focus.
There are many examples of data that ‘relates to’ an individual because the content of the information is clearly about that individual. For example:
- medical history;
- criminal record;
- a record of an individual’s performance at work; or
- a record of an individual’s sporting achievements.
There are also many examples of records which will clearly be personal data where the content of the information is about their activities not about the individual themselves. For example:
- personal bank statements; or
- itemised telephone bills.
There will also be many cases where data is not in itself personal data but, in certain circumstances, it will become personal data where it can be linked to an individual to provide particular information about that individual.
Example
If data about a job salary is included in a vacancy advertisement, it will not, in those circumstances, be personal data. However, if the same salary details are linked to a name (for example, when the vacancy has been filled and there is a single named individual in post), the salary information about the job is personal data ‘relating to’ that employee.
Example
An organisation has a number of employees with the same job title. This constitutes personal data when a particular individual can be identified from the job title information and additional information.
Does the purpose of the processing make information personal data?
If the data is used, or is likely to be used, to learn, evaluate, treat in a certain way, make a decision about, or influence the status or behaviour of an individual, then it is personal data.
Example
A company uses call logs from a desk phone to help identify when the person who sits at that desk was in the office.
Whilst the fact that a telephone was in use is not necessarily information relating to an individual in its own right, when associated with the individual who is allocated to that desk and used to assess performance, it is clearly information which relates to an identifiable individual.
There are many other examples of data which 'relate to' a particular individual because it is linked to that individual and informs or influences actions or decisions which affect an individual.
For example, an individual’s data about their phone or electricity account clearly determines what the individual will be charged. However, data about a house is not, by itself, personal data.
Context is important here. Information about a house is often linked to an owner or resident and consequently the data about the house will be personal data about that individual.
Example
Information about the market value of a particular house may be used for statistical purposes to identify trends in the house values in a geographical area. The house is not selected because the data controller wishes to know anything about the occupants, but because it is a four bedroom detached house in a medium-sized town. As soon as data about a house is either:
- linked to a particular individual, for example, to provide particular information about that individual (for example, his address); or
- used in deliberations and decisions concerning an individual (even without a link to the individual’s name, for example, the amount of electricity used at the house is used to determine the bill the individual householder is required to pay),
then that data will be personal data.
Example
An individual carries out unauthorised alterations to their house. The data about the unauthorised alterations is processed by reference to the house address. However, if the data is processed in order to decide whether to prosecute the house owner, the date clearly relates to the individual who carried out alterations.
Example
The value of a house is used to determine an individual’s liability for Council Tax, or to determine their assets or in proceedings following divorce. This is then personal data because the data about the house is clearly linked to the individual or individuals concerned.
Does the data impact, or have the potential to impact, on an individual?
If data is occasionally processed to learn something about an individual, even though it was not the controller’s primarily purpose for processing the data, this data will be personal data as the processing does, or is likely to, impact on the individual (see next question, below).
Example
A biscuit factory records information about the operation of a piece of machinery. If the information is recorded to monitor the efficiency of the machine, it is unlikely to be personal data.
However, if the information is recorded to monitor the productivity of the employee who operates the machine (and his annual bonus depends on achieving a certain level of productivity), the information will be personal data about the individual employee who operates it.
When considering data about objects, if the data is processed to provide information about an individual (for example, productivity) then the data is personal data. If the data about objects is not currently processed to provide information about an individual, but could be, then the data is likely to be personal data.
It depends on whether the processing of the information has or could have a resulting impact upon the individual even though the content of the data is not directly about that individual, nor is there any intention to process the data for the purpose of determining or influencing the way that person is treated.
Is data that refers to an identifiable individual, but does not relate to them, personal data?
Data can contain references to an identifiable individual, or be linked to them, but not ‘relate to’ them as it is not about that individual but is about another topic entirely. Depending on the circumstances, this data may or may not be personal data.
Example
Emails written by a lawyer to their client about their client’s matter all contain references to the lawyer’s name and place of work, which will be the lawyer’s personal data. However, the content of the emails are not about the individual lawyer, but about the client’s instructions. The content of the email is not, therefore, personal data where it concerns legal advice about the client’s legal query.
If a complaint was then made about the lawyer’s performance or advice and the emails were then used to investigate this, the legal advice given in them would become personal data.
Is inaccurate information about an individual still personal data?
If information seemingly relating to a particular individual is inaccurate (ie it is factually incorrect or it is information about a different individual), the information is still personal data, as it relates to that individual.
Example
Two people live in an apartment block who wear glasses. John lives on the ground floor and William lives on the top floor.
The landlord receives a complaint that the man wearing glasses who lives on the ground floor has engaged in anti-social behaviour. However, the complaint actually relates to activity conducted by William, who lives on the top floor.
The landlord records the information about the anti-social behaviour relating to John. This is inaccurate information but it is nevertheless personal data relating to John, which the landlord should correct if required to do so.
At the same time, this is also personal data about William, even though it’s been recorded about John.
If the information is inaccurate so that no individual can be identified from that information on its own or in conjunction with additional information, then the information is not personal data.
Example
The landlord then receives a further complaint that a tenant with a dachshund is also engaging in the anti-social behaviour.
There is nobody with a dachshund living in the apartments and, in fact, no tenants own a dog. This information does not relate to an identifiable data subject. This information is therefore not personal data.
An opinion relating to an individual is also capable of constituting personal data, irrespective of the accuracy of that opinion.