At The Shred Centre we often get asked, how do you actually classify what is personal data. So we thought we would blog about it.
In simple terms the data protection act says that personal data is data by which relates to a living individual who can be identified from the data or from data and other information which is in the possession of, or is likely to come into the possession of, the data controller. In addition it includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
Yes that is the simple version.
The truth is and what the above is trying to express is that classifying personal data depends on a much more than the nature of the data you are looking at. Considering information about the environment in which the data is being processed or managed and how any associated data can be used is just as important.
The ICO’s website gives a good example that illustrates how other information contributes personal data;
“An organisation holds data on microfiche. The microfiche records do not identify individuals by name, but bear unique reference numbers which can be matched to a card index system to identify the individuals concerned. The information held on the microfiche records is personal data.”
The definition also specifically states that opinions noted are also to be considered personal data, as are any intentions. Again they ICO website provides an example for clarity.
“A manager’s assessment or opinion of an employee’s performance during their initial probationary period will, if held as data, be personal data about that individual. Similarly, if a manager notes that an employee must do remedial training, that note will, if held as data, be personal data.”
Its a complex world out there!
Fortunately the ICO has issued a document giving guidance on how to classify what is personal data, to fully comply with your obligations under the data protection act you can follow the steps in the 8 step guide that can be found here every time you consider disposing of information.
Or alternatively give us a call to discuss our Shred All Paper services, we remove any risk of mis-categorisation of data and allow your staff to focus on their core duties, your staff should be focused on the growth of your business let us focus on the information security.
Use your head, Let us Shred.