Be wary of data day use of personal information
Just what constitutes personal data is being debated, says Rebecca Roberts
We should all be mindful how our personal data is collected, stored and processed. Rapidly- changing technologies, increasingly complex data ecosystems and escalating security risks have resulted in a need for robust global data protection laws to continuously evolve to help ensure organisations handle personal data responsibly.
At its core, data protection law is concerned with the protection of personal data. As a result, the boundaries for what is and isn’t personal data are fundamental to determining when legal obligations apply. The definition of “personal data” has been subject to recent scrutiny in the EU and UK, with some divergence emerging.
Last month the Court of Appeal issued its decision in DSG v ICO, a long-running debate whether certain data held by DSG (the parent company of Currys and PC World) constituted “personal data” and therefore triggered security obligations on DSG’s part.
In 2017-2018, cyber attackers installed malware on DSG point-of-sale terminals and, over nine months, stole details of over 5.6 million payment cards. Most cards were protected by chip-and-pin and in those cases, the attackers only obtained 16-digit card numbers and expiry dates, not cardholder names or other identifiers. However, DSG held information which could be used to identify cardholders from the payment card data.
The ICO investigated DSG under the Data Protection Act 1998 which applied at the time of the attack. They determined the payment card data was “personal data” and DSG had failed to apply appropriate security measures to protect this data, issuing a fine of £500,000. DSG appealed, claiming the 16-digit card numbers and expiry dates were not “personal data” in the hands of the attackers, who could not link data to individuals. DSG argued it was therefore not under a statutory duty to protect the security of that data and should not have been fined.
The case escalated to the Court of Appeal, which ruled in favour of the ICO and clarified that, because the payment card data was personal data in the hands of DSG, the company was subject to security obligations in respect of that data. It was irrelevant the attackers could not identify individuals from the data they stole.
The issues raised were subsequently addressed by the revised definition of “personal data” when the UK GDPR came into force, as this introduced the concept of “indirect” identification and clarified that “pseudonymous data” should be treated as personal data.
However, some of these concepts are now subject to change in Europe, potentially resulting in further divergence between UK and EU data protection laws.
Most notably, the European Commission has published its Digital Omnibus Regulation, including proposals for amendments to the EU GDPR. They include a change to the definition of “personal data” to reflect recent case law from the European Court of Justice. The proposal seeks to clarify that information will not automatically be “personal data” just because it may be identifiable to another person. This remains up for debate, with current rumours indicating these proposals might not be accepted by other European institutions involved in passing EU GDPR amendments.
While the legal definition of “personal data” is in flux, there is a broad consensus that the question of whether or not data is “personal data” should be assessed from the perspective of the holder of that data.
The message for organisations is clear: understand your data, assess its identifiability, protect it effectively, and ensure data flows and obligations are properly documented.
Rebecca Roberts is a Director, Burness Paull. This article was co-authored by fellow director Jo McLean