No name, still found
A leisure centre removes the name column from its member list. It keeps postcode area, date of birth and job title. A neighbour looks at the list and says, "That is Sam. Only one person aged 41 in ZZ1 is a vet."
Taking out the name did not hide Sam. An analyst must know what really identifies a person.
Key words
| Word | What it means |
|---|---|
| Personal data | Information about a living person who can be identified. |
| UK GDPR | The main UK law on personal data. |
| Personal identifiable data | Any data that could be used to identify a particular person. The UK law calls it personal data. |
| Direct identifier | A fact that names one person on its own, such as an email address. |
| Indirect identifier | A fact that points to a person when joined with other facts. |
| Right to erasure | A person's right to ask for their data to be deleted. |
| Impact assessment | A check made before a risky plan starts, to find harm to people and reduce it. |
| Database | An organised store of data in tables. |
| Query | A question you ask a database. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say what personal identifiable data is, deal with a right to erasure request and explain why an impact assessment is done.
Starter: last lesson
Have a go
Starter: last lesson
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
What counts as personal
The UK GDPR and the Data Protection Act 2018 define personal data. It is any information about a living person who is identified or can be identified. Many people say personal identifiable data. It means the same.
A direct identifier names a person. An indirect identifier points to a person when you add other facts.
Direct and indirect
| Field | Kind | Why |
|---|---|---|
| Full name | Direct | Names one person |
| Email address | Direct | Usually belongs to one person |
| Postcode | Indirect | Narrows down who lives there |
| Date of birth | Indirect | Together with a postcode it can find one person |
| Favourite sport | Not personal alone | Many people share it |
The cells students fill in are left blank in this preview.
The right to erasure
A person may ask you to delete their data. This is the right to erasure. You must answer within one month.
It is not absolute. You may keep data when the law says you must, or for legal claims. Always check before you delete. Then delete from every copy, and tell anyone you shared it with.
Try it: erase one member
DELETE FROM members WHERE id = 3;
SELECT id, name FROM members ORDER BY id;