Alison Berryman 
Personal data is a very broad category under UK and EU data protection law, and it often catches more than people expect. Below, Partner, Alison Berryman answers the questions we're most often asked about what counts as personal data and how the different types are treated.
[Please note: We’ve used the term “GDPR” in this article for simplicity, but this is intended to refer to both the EU GDPR and the UK’s post-Brexit version, which is very similar.]
What counts as personal data under the UK and EU GDPR?
Broadly speaking, personal data is any information that could be used to identify a living individual (note, you’re no longer protected when you’re dead!)
The GDPR definition is very broad. It includes the things you'd naturally use to identify someone, such as their name, address and email address.
However, what some people don’t realise is that it also includes any kind of unique identifier, for example, a username (even if it bears no relation to a person’s actual name) or a session ID on a website. The GDPR specifically calls out IP addresses as personal data - which some would argue doesn’t really make sense! It is also quite different from other jurisdictions, where data of that type wouldn’t be considered personally identifiable unless you could actually use it to identify a person.
Once you have that identifier – be it a name or some other thing - that connects a piece of information to an individual, everything else connected to that record, and which tells you something about the person, also becomes personal data.
For example, your CRM system will obviously hold a prospect’s contact details. But everything saved in there that can tell you something about them - their buying habits, which events they have attended, etc. - becomes personal data as well.
Are work email addresses and business contact details personal data?
Yes, they definitely are. It's actually quite a common misconception that if a piece of information is “just business-related” it doesn't count – but it absolutely does.
Personal data is anything that can be used to identify an individual, and a work email address often does exactly that. There's only one “Alison” at ClearCube Law, so you can tell who I am from that email address (alison@clearcube.law). The same is true for most people: an email address has to be unique to reach one person, and it almost always gives their name and place of work. That's enough to identify them.
What is special category data?
Under the old Data Protection Act and the old EU Data Protection Directive, there was a concept of "sensitive personal data". The GDPR replaced that with the term “special category data”. These are typically the types of things that people are the most sensitive about others finding out - and in some cases the sorts of things that can lead to discrimination.
They're listed quite specifically in Article 9 of the GDPR:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data, but only when it's used to identify somebody
- data concerning health
- data concerning a person's sex life or sexual orientation
Why does it matter? Because different rules apply. There are more limited circumstances in which you're allowed to process special category data and you have to jump through more hoops to make your processing legal.
Does GDPR apply to anonymised data?
The short answer is no: if data has genuinely been anonymised, the GDPR doesn't apply.
BUT the longer answer is that it's actually quite difficult for a dataset to be considered “anonymised” under the GDPR, so a lot of data that you might think was anonymous could still be caught.
As mentioned above, even if you've taken out everything that could identify the person’s name, it will still not be anonymous if it's a unique record with some other identifier. Anything that still has a unique identifier, like a number or a code, is considered pseudonymised – and all of the GDPR rules still apply.
The rationale is that, while there’s a unique record relating to a person, it may still be possible (even if difficult) to link information back to a person.
To absolutely anonymise something under the GDPR, your safest bet is to aggregate the data with other data, so you've got a statistical dataset rather than a set of unique records that could still potentially be used to identify a person.
What is pseudonymised personal data?
Pseudonymisation means replacing the personal bits of the data (e.g. a name) with some other kind of identifier. Usually, there's a list somewhere else that matches up those two bits of information: you've got the code in one place, and somebody somewhere knows who that person actually is. But even if the name or other original data is deleted entirely, the data is still considered “pseudonymised” rather than anonymised.
The key point to remember is that pseudonymised data is still personal data, and all of the GDPR rules still apply to it.
Under the GDPR pseudonymisation is considered to be a security measure, but it doesn’t fundamentally change the obligations to protect the data in accordance with the regulations.
What's the difference between personal data in the GDPR context and personally identifiable information (PII)?
PII is a term coined in the US, but which is becoming more and more prevalent in the UK – especially in the tech sector. However, it isn’t a term that’s recognised in the GDPR or UK GDPR, or anywhere else in UK legislation. Consequently, there is some lack of clarity about what PII actually means.
Most people who use the term PII will be using it to mean what you'd naturally think of from the words "personally identifiable information": information where you and I would recognise that we can identify a person, because we can see it's their name, their email address and so on. As mentioned above, this is a much smaller category than the GDPR definition, so the term should be used with caution!
It’s worth noting that privacy rules in the US, even in states that have a fairly comprehensive privacy regime, such as California, are quite different from the UK and Europe. Separate advice should always be obtained for the UK and EU.
If you have any questions about the processing of personal data in your organisation, please contact us at hello@clearcube.law