PSI as personal data: moving towards pragmatism

Hans Graux, ICT Lawyer

Personal data and data subjects

Definition:

“any information relating to an identified or identifiable

natural person ('data subject'); an identifiable person is

one who can be identified, directly or indirectly, in particular

by reference to an identification number or to one or more

factors specific to his physical, physiological, mental,

economic, cultural or social identity”

2

Not so easy…

Recital 26:

“to determine whether a person is identifiable, account

should be taken of all the means likely reasonably to be

used either by the controller or by any other person to

identify the said person”

Opinion WP136 on the Concept of Personal Data (2007):

“One should consider costs, intended purpose,

modalities of processing, incentives, interests for the

individuals, and organisational/technical risks”

3

Personal data in PSI

4

Crime data in Manchester – personal data?

Blurry real life case

5

Personal data Not personal data

Pushing the limits…

6

Adress lists and purely geographic data:

– Main Street has houses numbered from 1 to 250;

– Statue of Local Hero is located at coordinates 50.877931,4.703541;

– A nice shrubbery is planted at 50.86075,4.756103

Personal data? Surely not…

Seeking reason…

Pragmatic approach: distiction between:

– Personal data from its nature: contact data, health data, pictures

of persons,… : law clearly applies

– Personal data from its contextual use: geolocation, pictures of

environments, object data, …: only become personal data when

their use implies a linking to natural persons. If identifiability

(whether intended or not) is not a foreseeable result of normal

use, then data protection laws do not apply.

Not so much based on law, but on realism

7