You are here

Data protection watchdog clarifies “personal data”

31 August 2007

Four years after the Durant judgment on the definition of “personal data” under the Data Protection Act 1998 was handed down, the Information Commissioner has drawn up new guidelines setting out his position (Guidance 'Determining what is personal data').

Earlier guidance on the issue, according to the Commissioner, “reflected the fact that the Court of Appeal was widely understood to have adopted a rather narrower interpretation of ‘personal data’ and ‘relevant filing system’ than most practitioners and experts had followed previously”.

Ultimately, the courts remain the final authorities on matters of interpretation of the Freedom of Information Act, but the Commissioner’s guidance will act as a steer as to how the Act should be applied in practice.

According to the new guidance, whether public authorities are processing ‘personal data’ will be obvious in most cases, with the guidance to be relied on in less straightforward cases.

Starting with the question of identifiability, the guidance confirms the European Court of Justice’s finding in the Lindqvist case (C-101/01) that descriptive elements will allow third parties to identify a person. Neighbours of “the tall, elderly man with a dachshund at number 15 and who drives a Porsche Cayenne” will be able to identify him, making the description in question 'personal data' falling within the scope of the Act.

But the Commissioner also warns that “when considering identifiability it should be assumed that you are not looking just at the means reasonably likely to be used by the ordinary man in the street, but also the means that are likely to be used by a determined person with a particular reason to want to identify individuals. Examples would include investigative journalists, estranged partners, stalkers, or industrial spies.”

The guidance follows an eight-step process together with numerous examples illustrating when data can be regarded as ‘personal data’ depending on the circumstances and individuals processing it.

For instance, an estate agent taking pictures of a shop to include in marketing literature for the property, including pedestrians who happen to walk by at the time, would not be regarded as handling ‘personal data’. But if these pictures were handed over to the police after they called for evidence about a crime which took place at the same time, then this data would be regarded as ‘personal data’, as it would be possible to identify the pedestrians in the picture and call them as witnesses.

Separate guidance on ‘relevant filing system’ will be produced “in the near future”.

Flowchart: is the data personal data for the purposes of the Data Protection Act?

1. Identifiability: can a living individual be identified from the data, or, from the dat and other information in the possession of, or likely to come in the possession of, the data controller?

Yes – go to next question

No – data is not 'personal data' under the DPA

2. Meaning of ‘relates to’: does the data ‘relate to the identifiable living individual, whether in personal or family life, business or profession?

Yes – data is ‘personal data’

No – data is not ‘personal data’

Unsure – See 3 to 8.

3. Data ‘obviously about’ an individual: is the data ‘obviously about’ a particular individual?

Yes – data is personal

No – go to next question

4. Data linked to an individual: is the data ‘linked to’ an individual so that it provides particular information about that individual?

Yes – data is ‘personal data’

No – go to next question

5. Purpose of the processing: is the data used, or is it to be used, to inform or influence actiona or decisions affecting an identifiable individual?

Yes – data is ‘personal data’

No – go to next question

6. Biographical significance: does the data have any biographical significance in relation to the individual?

Yes – data is likely to be ‘personal data’

No – Go to next question

Unsure – go to next question

7. Does the information concentrate on the individual as its central theme rather than on some other person, or some objects, transaction or event?

Yes – data likely to be ‘personal data’

No – go to next question

Unsure – go to next question

8. Impact of the processing on individuals: does the data impact or have the potential to impact on an individaul, whether in a personal, family, business or professional capacity?

Yes – data is ‘personal data’

No – data is unlikely to be personal data.

Categorised in:

Procedures Police & Prisons Clinical negligence