united-kingdom privacy european-union data-protection
What constitutes PII w.r.t. DPA \ EU legislations?
<p>I have the following data items:</p>

<ul>
<li>Name</li>
<li>Office</li>
<li>Department</li>
<li>Parking space number</li>
</ul>

<p>I'm using <a href="https://ico.org.uk/media/for-organisations/documents/1549/determining_what_is_personal_data_quick_reference_guide.pdf" rel="nofollow noreferrer">What is personal data? – A quick
reference guide</a> to figure out what out of these items would be regarded as PII.</p>

<p>The first two questions are:</p>

<ol>
<li>Can a living individual be identified from the data?</li>
<li>Does the data ‘relate to’ the identifiable living
individual?</li>
</ol>

<p>The <em>Name</em> obviously ticks both of these which the document states is PII.</p>

<p>The other three are harder though.</p>

<ul>
<li>Office and Department mean nothing (assuming a lot of people work there), unless it is combined with the name.  Now they both inform an adversary where that person will be during their working hours.</li>
<li>If we assume that each employee has a car parking space then the car parking space number can be used to identify the person.  Again, an adversary could use this information for nefarious acts.</li>
</ul>

<p>The reference document does give me an option for "Unsure" for answering question 2, in which case the next question is:</p>

<ol start="3">
<li>Is the data ‘obviously about’ a particular individual?</li>
</ol>

<p>This, and the subsequent questions are where I'm starting to get unsure.  Office, department and car parking space don't <em>feel</em> like PII.  The document and my reasoning seem, to me, so suggest they would.</p>

<p>NB: I'm used to working with computers where things are generally black or white.  My argument above would hold if I was working with a security architecture, but maybe not with defining PII.</p>

<p>The guidance on the third question is not particularly useful, since they give an example of a "yes" situation, but do not indicate what would be a "no". The reason no doubt is that they do not want to be put in the position of saying "that is not", when a court may later decide "yes it is". You have to rely on the wording of the question, specifically the fact that it refers to being obviously about a particular individual. The two key terms here are "particular" and "obviously". The former means "uniquely", so a half-eaten sandwich is "about" some human, but there are billions of people that it could be about. "Obviously" is more a judgment call, but comes down to the question of whether there is a  path between the datum and the specific person which a person of average intelligence can see, versus (non-obviously) a hypothetical scenario whereby one might be able to connect a datum to a specific person.</p>

<p>The fourth question relies on relating "an individual", which in context we have to interpret as meaning relating "a specific individual" to the datum, as opposed to relating some set of individuals. Their example of a single person in a post being a "yes" (actually they just say it is "an example", but not what it is an example of) indicates that if the datum could be true of a number of individuals, then it is not established as being personal data (yet).</p>

<p>Q5 oddly implies that what you might do with data defines whether the data is "personal data", which is confusing, but amounts to saying "even if this is in the ordinary sense 'personal data', it is not subject to the protection requirements" – this is not uncommon in law, where rules are stated in terms of a label ('personal data"), and the rules are very simple, but the definition of the label can be complicated.</p>

<p>Q6 distinguishes "incidental" facts from "significant" facts. As they say, the fact that X attended a meeting is personal data; the fact that coffee was served is <em>not</em>, even though it is a fact connected to the meeting which is connected to the person. The fact that X (alone) had black coffee would be PD. Q7 is quite vague, but reduces to asking "what is the purpose of gathering the data": if the purpose is "about" individuals, it is PD, but if it is about processes / machines, move on to the next question. Finally, they ask whether the data "can impact" an individual (similar to Q5 but without the implication of specific intent to do so). Ordinarily, one would think the datum "has red hair" can't have an impact on an individual, but with a bit of creativity, one can construct a reasonable scenario where this could have an effect (such as tending to prejudice people against the individual).</p>

<p>The guidance that you are looking at is an interpretation of what the law requires, and it is helpful to look at multiple interpretations, such as <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/" rel="nofollow noreferrer">this one</a>. </p>
