3 ms·
>It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person. Why wouldn't it?
by M2Ys4U 8y ago
>It isn't clear to me that the GDPR requires disclosure of data that is related to a person but was not created by or provided by that person.
Why wouldn't it? If it's data about an identifiable individual then - by definition - it is personal data.
Furthermore, in the ICO's recent report into political parties' use of personal data[0], they expressed the following view:
"Our investigation found that political parties did not regard inferred data as personal information as it was not factual information. However, the ICO’s view is that as this information is based on assumptions about individuals’ interests and preferences and can be attributed to specific individuals, then it is personal information and the requirements of data protection law apply to it."
[0] https://ico.org.uk/media/action-weve-taken/2259369/democracy-disrupted-110718.pdf https://ico.org.uk/media/action-weve-taken/2259369/democracy... p29
- gwright 8y agoThere is a difference between the interpretation of the phrase "personal data" within the context of the GDPR and outside the context of GDPR. At least I think there is a difference. For example, consider a website that maintains a collection of birthdays for public figures derived from public sources (historical documents, news accounts, social media posts from the public figures themselves, etc.). In many jurisdictions the birth dates might even be available via public record searches. Clearly the birth dates are "personal data" in the colloquial sense of the phrase, but I don't think that the data as held by the website operator would be subject to the GDPR provisions, right?
- M2Ys4U 8y agoYes, those data would be personal data, and thus be subject to the GDPR. Personal data is _any_ information about an identified (or identifiable) natural person.