Читать книгу Privacy and Data Protection based on the GDPR - Leo Besemer - Страница 39

Indirect personal data is data that can be, or could be in the future, linked to a specific data subject using additional information. For example, the number plate of a car is indirect personal data, because it is possible to trace the car to its owner using additional information (in this case the information in a database where the number plates are related to the owners of the cars). The same is true for unique numbers assigned to people by the government (social security number) or by one’s ISP (IP address), which can be linked to a unique individual. The fact that not every controller is able to trace a license plate, social security number or IP address to the associated individual, is not important. The fact that it is possible to identify the data subject makes it (indirect) personal data.

Names are indirect personal data where the name is common enough not to point to a specific person. If you want to distinguish “James Williams” from other individuals by that name, you would need additional information such as residence and date of birth.

In practice, we usually work with a variety of data on a person which of itself is not personal data, but when combined links to a unique individual. That is the reason for always being careful with data on persons. It is usually not a single fact about a person, but the combination of data on a person that identifies a unique individual.