Personal Data

The much-discussed GDPR regulates data pro­tec­tion and has been in place since May 2018. The reg­u­la­tion stip­u­lates that it applies to web users in the EU, so if you have any contact with them, it may be a good time to wise up on the GDPR. Its content focuses in par­tic­u­lar on personal data, which both le­gis­lat­ors and internet users see as highly worthy of pro­tec­tion. On the other hand, numerous business rep­res­ent­at­ives see their ability to keep up in a com­pet­it­ive market, which is sig­ni­fic­antly based on big data, threatened by the stricter reg­u­la­tions. But what are personal data, and what rights do you have to your own?

The term personal data is generally un­der­stood as all data and in­form­a­tion that provide insights into the identity of a natural person – that is, into a person “made of flesh and blood,” although there is no clear cut legal defin­i­tion. This view therefore excludes legal entities and cor­por­a­tions, unless the partners and managing directors are the same in­di­vidu­al.

If, on the other hand, the data cannot be assigned to a specific person because it is com­pletely anonymous, no data pro­tec­tion rules need to be followed. The problem arises again with so-called “pseudonym-ised” data, which can also be used to determine a unique reference person if you have the necessary ad­di­tion­al in­form­a­tion. In case of doubt, the principle of caution always applies. Since it is sometimes difficult to dis­tin­guish between personal and non-personal data, you should always start from the former in order to guarantee the pro­tec­tion of po­ten­tially private in­form­a­tion. For example, data pro­tec­tion au­thor­it­ies assume that even IP addresses belong to personal data, since they can be clearly assigned to the re­spect­ive internet user through the in­ter­ac­tion of access and service providers.

In addition to the examples of personal in­form­a­tion already listed, the GDPR also defines “special” personal data relating to natural persons. These include:

• Ethnic and cultural back­ground
• Political, religious and philo­soph­ic­al views
• State of health
• Sexual ori­ent­a­tion
• Union mem­ber­ship
• According to article 9 of the GDPR, genetic in­form­a­tion (e.g. DNA analyses) and biometric data (e.g. pho­to­graphs and fin­ger­prints) are also included

Due to the sensitive nature of this in­form­a­tion, the relevant privacy reg­u­la­tions are much stricter. Ac­cord­ingly, pro­cessing special cat­egor­ies of personal data is in principle pro­hib­ited under Article 9(1) of the GDPR, unless the data subject has expressly consented to having their data processed (a de­clar­a­tion of consent for pro­cessing general personal data is not enough). Another way in which personal data may be processed is if there is a le­git­im­ate public interest in this in­form­a­tion, e.g. in the context of criminal pro­sec­u­tion. While the ap­point­ment of a pro­fes­sion­al data pro­tec­tion officer is normally a matter for con­sid­er­a­tion by the managing director, it is ob­lig­at­ory for the pro­cessing of special personal data.

It should be common knowledge that large internet companies such as Google and Facebook collect personal data about their users on a large scale. They mostly use these to place in­di­vidu­al­ised ad­vert­ising and generate economic profits. The data is mainly used for op­tim­ising sales and in­di­vidu­al­ising marketing mech­an­isms.

This is made more difficult, as people are becoming ever more cautious of what they data the disclose online, and fear becoming “trans­par­ent people,” rep­res­en­ted only by online data profiles. Recurrent cases of data theft and data abuse phishing and the use of Trojans fuel this fear even more. Because the more sensitive in­form­a­tion about an in­di­vidu­al is cir­cu­lat­ing, the greater the risk their financial and social in­form­a­tion is at.

Data pro­tec­tion reg­u­la­tions therefore make those with heaps of personal data re­spons­ible: companies and au­thor­it­ies are legally obliged to guarantee the pro­tec­tion of in­form­a­tion about their customers. This implies com­pli­ance with the following prin­ciples and practices laid out in the GDPR:

• Legality of data pro­cessing: The col­lec­tion, storage, use, and for­ward­ing of personal data to third parties is only permitted with the express consent of the data subject.
• Trans­par­ency: Companies and au­thor­it­ies are subject to com­pre­hens­ive ac­count­ab­il­ity, doc­u­ment­a­tion, and proof. At the request of a data subject, they must provide in­form­a­tion on all pro­cessing pro­ced­ures relating to his or her personal data.
• Ear­mark­ing: The use of data must be earmarked at all times and must not be arbitrary.
• Data min­im­isa­tion: Or­gan­isa­tions are required to collect only the most necessary data for their purposes and to keep the amount of in­form­a­tion stored generally low.
• Cor­rect­ness of data pro­cessing: Stored data must always be correct and up to date and updated if necessary.
• Storage lim­it­a­tion: There is a regular ob­lig­a­tion to delete data if it is no longer required for the purpose of an or­gan­isa­tion, if it has been stored illegally, or if a pre­de­ter­mined period of lim­it­a­tion has expired.
• Integrity and con­fid­en­ti­al­ity: Companies and au­thor­it­ies must take extensive measures for internal data pro­tec­tion. In addition to the use of en­cryp­tion programs and security software, this also includes detailed training of employees entrusted with data pro­cessing.

Vi­ol­a­tions of these prin­ciples can result in a fine of up to 20 million euros, or up to 4 percent of a company's worldwide annual turnover under Article 83(5) of the GDPR – a rule that provides a financial incentive to comply with the guidelines but still cannot guarantee absolute security for personal data. Data economy is therefore also an effective principle when surfing the internet. Fur­ther­more, it is re­com­men­ded to delete or at least falsify personal, address, and bank data entered after com­plet­ing an online purchase. Last but not least, it also makes sense to be aware of your rights towards companies and au­thor­it­ies.

The GDPR stip­u­lates three essential rights that people have when their personal data is collected:

Under European law, personal data must in principle be regarded as the property of an in­di­vidu­al. In practice, this means that the col­lec­tion, storage, pro­cessing, and for­ward­ing of data is only permitted with the express and active consent of the person in question. An implicit re­cog­ni­tion of the data pro­tec­tion practice of an online service is therefore not suf­fi­cient. A so-called coupling is also not allowed, in which a company or an authority only releases certain services against consent and leaves the user no free choice.

Under Article 15 of the GDPR, people also have a right of access to the companies and au­thor­it­ies to which they provide their personal data. The In­form­a­tion Com­mis­sion­er’s Office offers a short, informal sample letter, which can be easily adapted and sup­ple­men­ted with any extra in­form­a­tion you want to supply. The following questions are useful to get a good overview of the extent and procedure of data storage:

• Which data is stored about my person?
• Where is this data stored?
• How was this data collected?
• For what purpose were they stored?
• To whom was my data passed on?

Although companies and au­thor­it­ies are obliged by law to provide in­form­a­tion, in some cases you have to reckon with un­will­ing­ness or even har­ass­ment if you want these questions answered. This is where per­sist­ence pays off: by invoking your rights, setting a tight deadline, and ul­ti­mately threat­en­ing to consult the re­spons­ible data pro­tec­tion authority, you finally get the certainty that you deserve. And if you do not agree with the way in which data is collected, in­form­a­tion is incorrect or outdated, or has even been stored or passed on illegally, you can apply your last right: the right to correct, delete, and block data (Article 15(1e) GDPR).

Click here for important legal dis­claim­ers.