Chapter 2A: Data Protection Concepts

Question 1

The WP29 set out four ‘building blocks’ in Opinion 4/2007 to comprise the meaning of personal data. What are they?

Answer 1

‘Any information’
‘Relating to’
‘An identified or identifiable’
‘Natural person’

Question 2

Define ‘any information’ under WP29’s definition of personal data.

Answer 2

Made up of nature, content and format.

Nature - any statements about a person, objective or subjective, true or false

Content - personal data that includes information about an individual’s private life or any activity undertaken

Format - Information processed by automated means, including processing by manual means as well if part of a filing system

Question 3

Define ‘relating to’ under WP29’s definition of personal data.

Answer 3

Must be about an individual. Information that relates to objects, processes or events may constitute personal data in certain circumstances (e.g. an individual owns the car)

Question 4

Define ‘identified or identifiable’ under WP29’s definition of personal data.

Answer 4

A natural person is ‘identifiable’ when although the person has not been identified yet it’s possible to do it. A person can also be identifiable with combined information. There must however be reasonable likelihood that they could be identified.

Question 5

How could dynamic IP addresses constitute personal data?

Answer 5

An individual could be indirectly identified if the IP addresses were combined with data held by internet service providers (e.g. time of connection or pages visited).

Question 6

How does the regulation react to anonymised data?

Answer 6

It does not apply if it does not relate to an individual and the individual can no longer be identified - but complete anonymisation is difficult.

Question 7

What does pseudonymised data offer an organisation?

Answer 7

It helps to satisfy data minimisation requirements however still acts as personal data so is subject to the same rights.

Question 8

Aggregation of data for statistical purposes is likely to result in non-personal data, but why should care be taken?

Answer 8

Context may allow identification of individuals if the sample size is not sufficient.

Question 9

Define ‘natural person’ under WP29’s definition of personal data.

Answer 9

Recital 27 states that the regulation does not apply to the personal data of deceased persons, which may be protected through standard contractual confidentiality clauses but not subject to GDPR.

Question 10

Why does special category personal data merit specific protections?

Answer 10

The nature of the data could create significant risk to the individuals’ fundamental rights and freedoms.

Question 11

How is genetic data defined?

Answer 11

Personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or health of that natural person which result, in particular, from an analysis of a biological sample”

Question 12

What is the definition of ‘data that relates to health’?

Answer 12

Data related to physical or mental health of a natural person, including the provision of health care services, which reveals information about health status. This can be past, present or future health status.

Question 13

What is a data controller?

Answer 13

The natural or legal person/public authority or any body which alone or jointly determined the purposes and means of processing of personal data. They’re the key decision maker in regards to a set of data.

Question 14

What is a data processor?

Answer 14

A subordinate figure required to process personal data only on documented instructions from a controller. The controller retains liability, but a processor should ensure international data transfers comply with the regulation and that they have appropriate security and a process for notifying data controllers of data breaches.

Question 15

Different organisations can be controllers of the same set of personal data, but this does not always mean that they’ll be joint data controllers - give an example of these independent controllers.

Answer 15

A person books a holiday through a travel agent and that travel agent forwards the details to the chosen airline and hotel. They all hold identical data, but separately and for different purposes - they each determine separately what they do with the data.
A shared database between them would change this.

Question 16

What does article 28(10) say about processors?

Answer 16

If they infringe the regulation by determining purposes and means of processing, they will be considered to be a controller with respect to that processing.

Question 17

What is control stemming from explicit legal competence?

Answer 17

Explicit appointment of a controller under national or community law (i.e. the law imposes a duty on someone to collect data).

Question 18

What is control stemming from implicit competence?

Answer 18

Control stems from common legal provisions or established legal practice (e.g. an employer with employee data) - the capacity to determine processing activities can be considered to be naturally attached to the functional role of an organisation.

Question 19

What is control stemming from factual influence?

Answer 19

Responsibility as a controller is attributed on the basis of assessment of factual circumstances.

Question 20

A processor can have some discretion…

Answer 20

as to how it carried out the processing on behalf of a controller without itself becoming a controller only if the processor can point to another party responsible for the overall processing.

Question 21

What does the ‘means’ of processing refer to under Opinion 1/2010?

Answer 21

The technical ways of processing data and the ‘how’ of processing, i.e. which data will be processed, who shall have access, when will it be deleted.

Question 22

How does the regulation define a processor?

Answer 22

A natural or legal person, public authority, agency or other body who processes personal data on behalf of the controller. Must be a separate legal entity.

Question 23

Article 28 sets out content for a processing contract, which stipulate that the processor shall…

Answer 23

Only process data on documented instructions
Ensure that authorised persons have committed themselves to confidentiality
Take security measures, respect the conditions for enlisting another processor
Assist the controller with obligations
Delete or return all personal data to the controller at request
Allow for audits

Question 24

What responsibilities does a processor have when engaging subprocessors?

Answer 24

They should only do so with prior authorisation of the controller.
The contract between the processor and subprocessors must include mandatory provisions set out.
The initial processor remains fully liable to the controller for subprocessor performance.

Question 25

What is processing?

Answer 25

Any operation or set of operations performed on personal data whether or not by automated means

Question 26

Article 2 states that the following conditions must apply for processing of data to be covered by GDPR…

Answer 26

Processing must be wholly or partly carried out by automated means or must form part of a filing system or be intended to form part of a filing system