Key points
- The GDPR, applicable since 25 May 2018, defines personal data in Article 4(1) as any information relating to an identified or identifiable natural person.
- Identification can be direct (surname, first name) or indirect, by cross-referencing an email address, telephone number, IP address or location data.
- Article 9 gives enhanced protection to sensitive data: origin, political opinions, beliefs, health, biometric data or sex life.
- Pseudonymisation, defined in Article 4(5), processes data so that it can no longer be attributed to a person without additional information.
- Controllers must apply data protection by design (privacy by design) and by default (privacy by default).
- Security relies on encryption, access management, staff training and regular audits.
Wondering what “personal data” really means under the General Data Protection Regulation (GDPR)? As GDPR lawyers at Hashtag Avocats, we clarify this key concept so that you can understand your rights and obligations. In this article, we cover various legal and practical notions to help you grasp what the concept of personal data involves.
Legal definition of personal data
The GDPR, applicable since 25 May 2018, defines personal data in Article 4(1). Under this provision, personal data is “any information relating to an identified or identifiable natural person”. It therefore covers a wide range of information that makes it possible to directly or indirectly identify a person.
The CNIL (Commission Nationale de l’Informatique et des Libertés, the French data protection authority) confirms this definition and states that personal data covers several types of information. But what is this information in practice?
Direct and indirect identification
When we talk about direct identification, the obvious information comes to mind at once, such as surname and first name. However, indirect identification results from combining different data. For example, cross-referencing the following information could make it possible to reconstruct a person’s identity:
- Email address
- Telephone number
- IP address
- Location data
This underlines the importance of protecting even seemingly harmless data, because it could be used together with other pieces of information to identify someone. For advice on these questions, consult a GDPR lawyer.
Types of data considered personal
Personal data can be grouped into several categories, from general data to sensitive data. Here is a more detailed overview:
General data
General data includes information that is widely collected but which, when combined, makes it possible to identify a person. Some common examples are:
- Surname and first names
- Date of birth
- Assigned number series (social security number, bank card number)
Sensitive data
Under Article 9 of the GDPR, sensitive data deserves enhanced protection because of its potentially discriminatory or sensitive nature. It concerns:
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic data, biometric data for the purpose of uniquely identifying a natural person
- Data concerning health
- Data concerning a natural person’s sex life or sexual orientation
The pseudonymisation process
Another key aspect to consider with personal data is pseudonymisation. Under Article 4(5) of the GDPR, pseudonymisation means processing personal data in such a way that it can no longer be attributed to a specific person without the use of additional information. This reduces the risks associated with data processing while preserving the data’s usefulness for statistical or scientific analysis.
Benefits of pseudonymisation
This process offers organisations several benefits:
- Improve data security
- Reduce risks in the event of a data breach
- Facilitate GDPR compliance measures
To understand how PSD2 affects personal data protection, explore the legal impact of PSD2 on the GDPR.
Obligations and responsibilities
As an entity processing personal data, you need to understand your obligations under the GDPR. Controllers must ensure data protection by design (“privacy by design”) and by default (“privacy by default”).
Technical and organisational measures
To ensure adequate data protection, appropriate technical and organisational measures must be put in place. These include:
- Data encryption
- Access and authentication management
- Ongoing staff training
- Regular security audits
These measures aim to protect data and prevent any unauthorised access, loss or alteration.
Penalties for non-compliance
Non-compliance with the GDPR can lead to severe penalties. Fines can reach up to €20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 83 of the GDPR).
Well-known penalty cases
Several companies have already been heavily penalised for breaching data protection rules. Well-known cases include:
- A search engine fined €50 million by the CNIL in 2019 (information given to users and legal basis for personalised advertising)
- An e-commerce giant fined €35 million in 2020 for cookies placed without consent (Article 82 of the French Data Protection Act, loi Informatique et Libertés)
Frequently asked questions on personal data under the GDPR
What are the main implications of the GDPR for businesses?
| Obligation | Description |
|---|---|
| Legal basis | Base each processing operation on one of the six legal bases in Article 6 (consent, contract, legal obligation, vital interests, public interest task, legitimate interest); explicit consent is required only in certain cases, in particular for sensitive data. |
| Data subjects’ rights | Make it easy for individuals to access, rectify and erase their data. |
How do you tell ordinary personal data from sensitive data?
- Ordinary personal data: name, address, telephone number
- Sensitive data: information on ethnic origin, political opinion
