5.2.1 - Personal data, privacy and consent

Personal data and privacy

Imagine an activity app called MoveMore. It records an email address, a membership number, daily distance and the route taken. Some of those values name a person directly; others can still single out the person when linked to an account.

The living person whom the information is about is the data subject. Personal data is not limited to secret or embarrassing facts. A public profile photograph, an online identifier and a location record can still be personal data because each relates to an identifiable person.

Processing means doing something with personal data. Collecting, recording, organising, storing, viewing, changing, sharing and deleting are all forms of processing. An organisation cannot avoid its responsibilities by saying that it "only stores" the data.

Privacy is not the same as secrecy. Someone can willingly share their running distance with friends while reasonably expecting their exact home address and route history not to be published. Privacy depends on what is collected, why, who can use it and what consequences the use may have.

Worked classification

MoveMore holds the following information:

Removing a name is therefore not automatically the same as anonymising data. The deciding test is whether a living person is still identifiable, directly or indirectly.

Ownership, control and rights

The word ownership can be misleading when discussing personal data. A person does not simply possess every copy of every fact about them, and an organisation does not gain unlimited freedom merely because the data sits on its server.

A separate organisation that processes data only on the controller's instructions is a data processor. For example, MoveMore may be the controller while a cloud-storage company acts as its processor. Using a processor does not remove the controller's accountability.

It is more precise to separate several questions that are sometimes bundled together as ownership:

For general personal-data processing, a data subject has rights that can include being informed, accessing a copy, correcting inaccurate data, restricting or objecting to some processing, moving certain data, and requesting erasure in certain circumstances. These rights give people control and protection, but they are not all absolute. For example, a controller may need to retain a payment record to meet a separate legal obligation even after the person asks for every record to be erased.

Worked example

Amara joins MoveMore. She supplies her email address, while the app generates a membership number and distance history.

• Amara is the data subject because the records relate to her.
• MoveMore is the controller because it decides that the data will be collected and how it will be used.
• Amara can ask to see her data and correct an inaccurate email address. She does not need to own the database or server to exercise those rights.
• MoveMore must answer for its processing decisions. Holding a copy does not give it permission to use the records for any purpose it chooses.

This resolves the nearest misconception: rights over personal data are not identical to property ownership, while organisational ownership of a dataset is not a licence for unrestricted use.

Valid consent

Consent can give a person genuine choice over a particular use of their personal data. However, a click is not automatically valid consent.

When an organisation relies on consent, it should be possible to answer all of these questions:

1. Freely given: can the person refuse without an unfair penalty?
2. Specific: is each purpose clear rather than hidden inside a blanket request?
3. Informed: does the person know who will use which data, what they will do with it and how to withdraw?
4. Unambiguous and affirmative: did the person actively opt in, rather than remain silent or accept a pre-ticked box?
5. Withdrawable: can the person change their mind as easily as they gave consent?

Consent is one possible lawful basis for processing; it is not required for every legitimate use of personal data. For example, some processing may instead be necessary to perform a contract or meet a legal obligation. The controller must choose an appropriate lawful basis and still follow the data-protection principles.

Worked consent check

MoveMore wants to send account login links and also share route history with a named advertising company.

• Using an email address where genuinely necessary to provide the requested account service may rely on a basis such as performance of a contract. MoveMore should not pretend that this necessary processing is an optional marketing choice.
• Sharing route history for advertising is a separate purpose. If MoveMore chooses consent as its basis, it needs a separate, clear, optional opt-in that identifies the data, recipient and purpose.
• A pre-ticked marketing box fails the affirmative-action test. A compulsory box fails the freely-given test when the advertising use is unnecessary for the account service.
• If a user withdraws valid advertising consent, MoveMore must stop future processing that relied on that consent. Withdrawal does not make earlier lawful processing retrospectively unlawful, and it does not automatically erase records that must be kept under a different valid legal duty.