You may identify an individual:
1. Directly – based on the data you are processing, for example unique identifiers such as a personal telephone number, name or personal email address. Processing of such data is in the scope of the PDPL.
2. Indirectly – based on the data from several databases, if such databases could be linked with each other and, as a result, an individual could be identified. In such cases, the data in these separate databases shall be considered personal data. Its use shall be regulated by the PDPL. However, if linking the databases cannot lead to identification of the individual, then the data from such databases would not be considered personal data. It would be outside the scope of the PDPL.
Please note that you must consider each case separately to understand if under given circumstances it is possible to identify an individual.
Example | Personal data | Directly identifying an individual
A retail store collects the phone numbers of each customer before selling products to them. This is done in order to send customers text messages about new sales offers. The retail store does not collect the names of its customers.
The phone numbers are linked to the names of specific customers in the database of the telecommunication provider. Therefore, the phone numbers will be considered personal data for the telecommunication provider.
The phone numbers will be considered personal data for the retail store as well – even if the store does not have access to the database of the telecommunication provider. This is because each phone number is assigned uniquely to one individual, the retail company can single out the individual from all other customers based on his phone number and may use such a phone number to contact the individual and address sales offers particularly to him.
Therefore, both the retail store and the telecommunication provider will need to protect the phone numbers in accordance with the PDPL.
Example | Personal data | Indirectly identifying an individual
A company’s physical security department stores the following data in two separate databases in separate systems:
Database 1: this database contains names, phone numbers and employee IDs, which are used for identity and for payroll management;
Database 2: this database contains data on the vehicles that entered and exited the company premises. Such database is used to issue warnings for parking violations.
In this case, Database 1 stores data that can directly identify an individual and thus contains personal data.
While Database 2 does not store data that can directly identify an individual, the company is able to link the two databases together to identify the owner of a vehicle. Thus, the data in Database 2 should also be considered personal data. Its use will be regulated by the PDPL.
Example | Personal data | An individual cannot be identified
A pharmacy decided to analyze its commercial data for the previous year. Before doing an analysis, it irrecoverably deleted from the purchase history the data that could be linked to particular individuals, including phone numbers and bank card numbers.
After such deletion, the pharmacy only had the following data:
1. The name and type of the product.
2. The details of the items of the products sold during the previous year.
3. The price for which the product was sold.
The above data in the dataset is not considered personal data. Its use will not be regulated by the PDPL.