Personal data, processing and the scope of the GDPR
The definitions of article 4 of the GDPR, the special categories of data, the difference between pseudonymising and anonymising, and when the regulation applies or not: classifying a piece of data, an actor and a processing operation.
- 24 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
Personal data: what is it?
Show the answer
Any information relating to an identified or identifiable natural person, directly or by cross-referencing.
A name, an e-mail address, an IP address or an account identifier all qualify. A person is identifiable as soon as they can be found with reasonable means, even without their name.
A start-up publishes a file from which name and e-mail were removed, but which keeps birth date, postcode and sex. What can be said about it?
- It may remain personal: these fields combined often single someone out
- It is anonymous, since no field contains a name or an e-mail address on its own any more
- It is pseudonymised, because the correspondence table is stored elsewhere
- It is sensitive, because the birth date falls under article 9
Show the answer
It may remain personal: these fields combined often single someone out
Anonymity is judged on whether the person can be found, not on whether a name is present. Here, identification by cross-referencing remains realistic; a birth date is not sensitive data.
Regulation (EU) 2016/679, the GDPR, has applied since … in every Member State of the Union.
Show the answer
Regulation (EU) 2016/679, the GDPR, has applied since 25 May 2018 in every Member State of the Union.
It is a regulation: it applies directly, without a transposing statute. The French act of 1978 supplements it on a few points.
Sensitive data (special categories): what is it?
Show the answer
Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, or concerning health, sex life or sexual orientation, genetics or identifying biometrics.
Article 9 prohibits them in principle, unless an exception applies (explicit consent, vital interest, health care…). The social security number is not one of them, but it has its own regime.
A US company with no establishment in the Union sells online in French, in euros, with delivery to France. Does the GDPR apply to it?
- Yes: it targets people located in the Union
- No: it has no establishment in the Union
- No: only US law governs a US company
- Yes, but only above 250 employees
Show the answer
Yes: it targets people located in the Union
The territorial scope also covers targeting: language, currency and delivery show it addresses people in the Union. The 250-employee threshold only concerns a relief from the register.