What is personal data (and what isn't)? A practical explanation
There is a lot of theory about what personal data is. In this article we want to answer a more concrete question: in practice, what is personal data?
Because in the end, complying with data protection laws comes down to exactly that: knowing when we are processing personal data and when we are not.
There is no universal definition
It may sound surprising, but no two data protection laws define it in exactly the same way.
That happens because data is a representation of reality, and what can identify a person often depends on context.
Even so, almost every regulation agrees on one central point: personal data is information that says something about a person.
The debate starts when we try to answer a different question:
when does a piece of data refer to a person? The answer changes from one law to the next.
What Chile's new law says
In Chile, the definition will change when Law 21.719 comes into force. It establishes:
“Personal data: any information linked to or referring to an identified or identifiable natural person.
A person shall be considered identifiable when their identity can be determined, directly or indirectly, in particular by means of one or more identifiers, such as their name,
their identity card number, or the analysis of elements specific to that person's physical, physiological, genetic, psychological, economic, cultural or social identity.
To determine whether a person is identifiable, all objective means and factors that could reasonably be used for that identification at the time of processing shall be taken into account”
Let's take the definition apart
Looking at the components of this definition:
It refers to natural persons: this excludes legal entities, and it covers every natural person. Many organizations treat only their customers as data subjects; this makes it clear that this is not correct, and that they have to consider every natural person. Careful: it isn't only customers, it's anyone.
Information linked to or referring to: it is any information, not limited to some particular type of information (the law only sets out categories, which we'll look at in another article) that can be linked to a natural person. And what comes next is the key part:
An identified or identifiable person: the law goes into this at length, and says it isn't only information that can be associated directly with a person, but also information where their identity can be determined indirectly. That isn't so obvious, because data is contextual and the data needed to identify someone depends on that context. What the law does say is that all objective means that could reasonably be used for that identification must be taken into account. And here is the factor that is essential in the world of data: context.
An example of why context matters
It's obvious that name and RUT are personal data. But let's look at another case, the one in this image:
No name or RUT was mentioned.
But everyone in the room knows exactly who it is.
For the people in that room, the person is perfectly identifiable, because they saw them. Someone who isn't there, on the other hand, could not identify them.
This example shows that whether data is identifiable or not depends on the context in which it is used, or in which the processing takes place. Put another way, it depends on the additional data available to work out which person the data refers to.
A real case in Chile
When the first COVID case appeared in Chile, many outlets reported that it was a man who had traveled from Santiago to Talca, his profession, where he worked and other extra details. They never said his name.
But they gave enough details for a lot of people to know who he was.
That shows that even without naming someone, they can be identifiable.
What is PII? Is it the same as personal data?
In the literature — especially the US literature — the concept of PII (Personally Identifiable Information) comes up often.
That concept is not exactly the same as personal data.
The term PII usually refers to the data that identifies a person directly, for example:
social security number
RUT
passport number
In other words, the identifier.
In Chilean law (and in the European GDPR too), by contrast, the concept is broader.
Personal data can be any information about an identified person.
For example:
“Pedro has a disability.”
A disability on its own doesn't identify anyone.
But if we know the disability is a characteristic of Pedro, it becomes personal data (and sensitive data at that).
Let's see it with a practical example
So, a practical example (with made-up data):
In this table:
The RUT is the identifier (PII).
That identifier turns every other field into personal data.
Because now we know exactly whose age, comuna and disability status these are (and that last one is sensitive personal data)
So whenever you are dealing with personal data you have to comply with the law in force, no exceptions, and you have to work to reduce the risk (for the data subject and for the organization)
One of the most effective ways to reduce risk is by AVOIDING the use of personal data. To do that, you have to ask what the purpose of using the personal data is. If the goal is statistical analysis, a good way to lower the risk is to remove the identifier.
For example, deleting the RUT column.
That reduces the risk of identifying people.
But the risk drops even further (it can disappear) if the identifier is never collected in the first place (here, the RUT). So if you don't need it, it's better not to collect it, and the risk drops at the source.
So what isn't personal data?
If the goal is to reduce regulatory risk, a good practice is to work with data that does not make people identifiable.
Two common ways are:
Anonymous data
This is data that cannot be linked to a specific person.
Example:
“An 84-year-old lives in Lo Espejo.”
If there is no reasonable way to identify them, it is not personal data.
Aggregated data
This is data that comes from grouping many individual records.
Example:
“40,000 people over 80 live in Lo Espejo.”
This kind of information usually shows up in censuses, statistical studies or public reports.
Here no one in particular can be identified.
The key: always think about identifiability
The main takeaway from this article is this:
It isn't just the data itself that matters. What matters is whether that data, or a set of data, makes it possible to identify a person.
So when designing processes or systems that will use personal data, we should always ask ourselves:
do I need to identify the person?
could I work with anonymized data?
can I use aggregated data?
The less data you use, the lower the risk that it can be linked to a person and, with it, the regulatory and privacy risk.
