Personal data can also include opinions and inferences if an individual can be directly or indirectly identified from them. If an organization attaches opinions or inferences to an individual then, no matter whether such opinions or inferences are correct, they are likely to be considered personal data.
Example | Personal data | Opinions
An HR department conducts a survey regarding the satisfaction of employees with the work environment. Based on this survey, the HR department prepares a report on how the work environment could be improved.
In this case, the opinions of the employees will be considered as personal data.
Example | Personal data | Inferences
A pharmacy has a database with a purchase history of its customers. The database links specific customers to the medicines that they have purchased.
Based on the purchase history, the pharmacy makes inferences about the health conditions of its customers and based on such inferences it conducts analytics.
The inferences that the pharmacy makes about the health conditions of their customers will be considered personal data. It will be considered sensitive data even if some customers did not buy medicines for themselves (for example, they bought medicals for their relatives).
Note: In this example, a customer database is maintained on the purchasing history of the individual. The pharmacy is not able to differentiate between purchases that customers make for themselves or others.