Information Under Privacy Laws" width="1200" height="650" />Information Under Privacy Laws" width="1200" height="650" />
The term "personal information" is defined slightly differently across privacy laws, but it always refers to information that can be used to identify an individual such as a name, home address, phone number, and even an IP address.
Your business probably collects, stores, and shares personal information every day. This means you're subject to legal obligations that you might not even be aware of. It's essential to understand what personal information your company uses and holds. Thus, the starting point for complying with many important laws and avoiding some very severe penalties is to understand what laws mean when they refer to "personal information."
This article will help break down the definition of this key term in a number of different privacy laws.
Some examples of types of personal information include but aren't limited to contact details, ID numbers, online identifiers and other types of personal information.
Different laws define personal information in different ways. We're going to look at lots of different types of information, but note that not every privacy law will consider every example to be "personal information." We'll look at some individual privacy laws later in the article.
"Contact details" can include the types of information you might use to get in touch with a person, such as:
A person's full name is probably the most obvious example of personal information. But in fact, even a person's first name alone can represent personal information.
It's all about context. For example, the first name "Robert":
An email address:
Although ID numbers appear to be a string of random digits, they can also qualify as personal information.
Not every ID number is personal information. For example, in the United States:
Types of online and technical information that might count as personal information include:
It's important to remember that not all of these types of information are considered personal information in every context, or under all privacy laws.
When a user visits a website within an online advertiser's network, the advertiser will install tracking software on the users' device (e.g. a "cookie"). This tracking software records which websites the user visits, what they're searching for, and sometimes where they're located.
It's not hard to see why regulators and legislators have taken an interest in this sort of business activity. A person's internet activity can reveal a lot about them. The more an online advertiser knows about people, the better its product targeting will be. This rampant collection of personal information is why privacy law is so important right now.
A typical business can process online and technical identifiers in several ways:
Subjective personal information can include things such as:
This is a contentious area, but it's important to consider whether you hold this kind of information. If you can link any information to a living individual, it could be personal information.
Some personal information is objective. A customer might provide your company with their name, address, or IP address. You might ask them for it, you might receive it from someone else, or you might acquire it through the ways they have interacted with your services.
Under certain privacy laws, you'll need to provide access to all the personal information you hold about a person at their request. This might make you think twice before sending an email about someone or making a note on their file.
It's good practice to disguise personal information in your possession, in case it's lost or stolen. It's important to distinguish between three types of disguised data:
Under many privacy laws, encrypted and pseudonymized data is still considered personal information.
Therefore, even if you're taking great care to disguise personal information, you must still store it securely. You must also securely store any key or additional information that could be used to link the data to an individual.
Anonymized data is not personal information. But remember - true anonymization cannot be reversed.
To qualify as anonymized data:
Different laws have different definitions of what constitutes sensitive information, but typical examples include information about:
Some personal information is more sensitive than other types. Many privacy laws recognize a category of personal information that must be treated especially carefully.
Some laws require that you only process sensitive information with consent. Some laws require that you take specific action in the event of a data breach involving sensitive information.
It's crucial that you know whether any of the personal information you hold should be treated as "sensitive."
Some more obscure types of data can represent personal information in some circumstances. For example:
Any of these data sets could be personal information if they can be linked to a living individual.
Start generating the necessary legal agreements for your website or app in minutes with TermsFeed.
We also offer different solutions and tools for your website or app:
No matter where your company operates, you'll be under some legal obligation to treat personal information with respect. But the extent of this obligation varies. Stricter privacy laws have stronger rules about how companies store and provide access to personal information. They have bigger fines in place to deter violations. And they also define "personal information" in different ways.
Personal information is called "personal data" under EU law. The General Data Protection Regulation (GDPR's) definition of personal data is at Article 4(1). Personal data is:
"any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier [. ]"
The Article 29 Working Party, an EU data protection advisory body (now replaced by the EU Data Protection Board) breaks down the definition of personal data into four parts:
All the examples of personal information we examined above are personal data under the GDPR.
Here's a great example of how broadly the GDPR defines personal data, taken from the Privacy Policy of Electrolux. Note section G, in particular:
Here, the operating data generated by an appliance such as motor power, opening of internal valves, water and energy consumption and other bits of information are disclosed as being "personal data" collected.
If a piece of information can tell you something about a person, even if you'd need extra information to work out who that person is, you should treat it as personal data under the GDPR.
The California Online Privacy Protection Act (CalOPPA) calls personal information "personally identifiable information." Helpfully, CalOPPA lists the types of information it considers personally identifiable information:
This doesn't leave much room for interpretation.
CalOPPA requires website operators to disclose the types of personally identifiable information they collect, along with some other information about how they use such information.
Here's an example of a relevant part of Feel the Lean's Privacy Policy:
Including a clause like this in a Privacy Policy that you appropriately display is a huge part of satisfying CalOPPA requirements.
The California Consumer Privacy Act (CCPA's) definition of personal information is heavily inspired by the GDPR's, but is arguably even broader:
"information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."
Section 2 (1) of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) defines personal information as "information about an identifiable individual."
PIPEDA doesn't provide any examples. However, Canada's privacy watchdog, the Office of the Privacy Commissioner clearly considers a wide variety of types of information to be personal information, including IP addresses and cookie data.
According to Australia's Privacy Act, and the all-important Australian Privacy Principles:
The Office of the Australian Information Commissioner (OAIC) offers some guidance on how to interpret this definition. This guidance refers to "a broad range of information", and includes specific examples such as a person's browsing history.
Note the word "reasonably" narrows the definition of personal information. The OAIC notes that:
"Even though it may be technically possible to identify an individual from information, if doing so is so impractical that there is almost no likelihood of it occurring, the information would not generally be regarded as 'personal information'."
This implies a narrower definition of personal information than in some other places, such as the EU.
New, stricter privacy laws are being passed all over the world. The trend is towards more regulation, and a more expansive definition of personal information.
Here are some examples:
Our article on Cookie Consent Outside of the EU is a great resource if you want to know more about international privacy law.
Almost all businesses process a substantial amount of information as part of their everyday business practices. It's crucial to understand which data sets are "personal information" under relevant privacy laws and ensure that you're complying with the law when it comes to how you collect, share, store this information.
Many privacy laws define personal information as information about a living individual, But some laws interpret this more broadly than others.
Take a cautious approach to legal compliance, and always respect your customers' privacy.
Comply with the law with our agreements, policies, and consent banners. Everything is included.
Disclaimer
This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.
Last updated on
Appears in
Related articles
The Internet of Things (IoT) has the potential to make people's lives easier and more efficient, but the trade-off could be the potential issues that could arise over the security of collected personal data. If you're developing IoT devices, you must address these privacy issues when designing your device. Do so.
Privacy Policies aren't just required for big businesses. Anyone who collects personal information from users via their website or app should have a Privacy Policy to help comply with applicable privacy and data protection laws. This article explains what a Privacy Policy is, why individuals need one, what laws require a.
Any business that handles personal information from Canadian residents needs to make sure that it maintains a Privacy Policy that complies with Canadian data protection laws. This article will cover the Canadian privacy laws that companies that do business with Canadian citizens need to be aware of, as well as how.
Comply with the law with our agreements, policies, tools and cookie consent banners. Everything you need is included.
Disclaimer: Legal information is not legal advice, read the disclaimer. The information provided on this site is not legal advice, does not constitute a lawyer referral service, and no attorney-client or confidential relationship is or will be formed by use of the site.
Copyright © 2012 - 2024 TermsFeed ® . All rights reserved.
