Foundations: ethics, privacy and the law
What personal data really is
Tell personal data from other data, recognise the sensitive kinds the law guards most, and see why "anonymous" data is often not anonymous at all.
By the end of this lesson you can tell personal data from other data, recognise the special, sensitive kinds, and explain why data called "anonymous" often still points to a person.
Why it matters
Almost every rule in this course turns on four words: "is this personal data?" If it is, the law applies and a mistake can cost a fine. If it is not, most of the rules fall away. A team that cannot tell the difference either breaks the law by accident or wastes effort protecting data that needs none. This is the first skill, and everything else rests on it.
The idea in plain words
Personal data is any information that points to a living person. Sometimes it points straight at them, like a full name or a photograph. Sometimes it points sideways: a phone number, a car number plate, a staff ID, a home address, or a trail of locations. On its own a single clue may seem harmless. Put a few clues together and they name a person as surely as a signature.
Think of a jigsaw. One piece shows a patch of colour and tells you little. Join enough pieces and a face appears. Data is the same: the question is never "does this one field have a name in it?" but "could this, alone or joined with other information, pick out one person?"
Three fields that name nobody on their own can, together, point to a single person. That combination is personal data.
Personal data: any information relating to an identified or identifiable living person, directly (a name, a photo, an email) or indirectly (a device ID, a number plate, or a combination of details that singles someone out). This is the definition used in Europe's GDPR (Article 4(1)) and in Nigeria's Data Protection Act 2023.
Special-category (sensitive) data: the kinds the law guards most strictly, because misuse can cause real harm or discrimination: data about health, race or ethnicity, religious or political belief, trade-union membership, sex life or sexual orientation, genetic data, and biometric data used to identify a person (such as a fingerprint or face scan). Europe lists these in GDPR Article 9.
Anonymous vs pseudonymous: truly anonymous data cannot be traced back to a person by anyone, so it is no longer personal data. Pseudonymous data has the obvious identifiers swapped for a code, but a key still links it back, so it is still personal data and still covered by the law.
See it done
Here is a short list. For each item, the question is only: could this pick out one living person, alone or joined with other information?
| Item | Personal data? | Why |
|---|---|---|
| "Amaka Obi, 14 Lagos Street" | Yes, and nothing special | A name and address identify a person directly. |
| A single office postcode, by itself | Usually no | It describes a place, not a person, and many people share it. |
| Staff ID "E-2291" plus the building rota | Yes | The code plus the rota singles out one employee. |
| A fingerprint used to unlock a till | Yes, and sensitive | A biometric used to identify someone is special-category data. |
| "412 customers were served in June" | No | A total about a group names no individual. |
The pattern: look past whether a name is present. Ask whether the item, combined with what else is reasonably available, points to one person. If yes, it is personal data. If it is about health, belief, ethnicity, biometrics and the like, it is also sensitive.
Your turn, with help
Decide whether each is personal data, and if so whether it is sensitive.
- A photograph of a named employee wearing a hospital patient wristband.
- The average age of everyone in a village.
Hints: For 1, a photo identifies a person, and ask what the wristband reveals. For 2, does an average point to any one person?
Show the answer
- Personal data, and sensitive. The photo identifies the person, and the patient wristband reveals that they are receiving health care, which is health data.
- Not personal data. An average describes a group and singles out nobody.
Your turn, alone
Classify each as "not personal", "personal", or "personal and sensitive".
- A car number plate captured by a shop camera.
- A list of staff names next to their trade-union membership.
- The total rainfall in a city last year.
- An email address of the form [email protected].
Watch out
- "Anonymised" data is often not anonymous. If a few fields can be joined back to a person, the data is only pseudonymous and the law still applies. Removing the name is rarely enough.
- A work email is still personal data. [email protected] identifies a person, even though it belongs to a workplace.
- Sensitive data can hide in plain items. A photo, a canteen menu choice, or a car-park permit can reveal health, religion or disability without ever using those words.
Say it back
- In one sentence, what makes information "personal data"?
- Name three kinds of special-category data.
- Why is pseudonymous data still personal data?
What is next
You can now spot personal data. Next we meet the three people the law cares about around that data, and settle who is actually responsible when something goes wrong.