Personal data
Data protection legislation applies only to personal data about a living, identifiable individual.
Personal data is data about a living individual. That living individual must be identifiable, either directly or indirectly, usually through a so-called identifier (such as name, identification number, GPS location data or online identifiers such as a computer IP address).
Directly identifiable
Directly identifiable means identifiable from the information itself, for example, a name together with an address, age, telephone number.
Indirectly identifiable
Indirectly identifiable means not identifiable from the information itself, but from the information combined with data from another easily available source.
|
Important for determining whether individuals are indirectly identifiable is content, context and whether a ‘motivated intruder’ would be willing to spend the time, effort and expense to attempt to identify somebody.
|
The personal data must be held by the University either electronically or in paper format in a ‘relevant filing system’.
Special categories of personal data
Some personal data is classed as special categories of personal data. This type of data is subject to stricter regulation under data protection legislation and can only be processed under certain circumstances.