The Privacy Act General Data Protection Regulation (AVG) defines personal data as: "any information about an identified or identifiable natural person. This means that information is either directly about someone, or is traceable to that person.
The definition of personal data is found in Article 4(1), AVG.
There are many types of personal data. Obvious personal data are a person's name, address, phone number and passport photograph. But personal data also includes what a person buys on the Internet, whether that person has allergies, and images from a surveillance camera where that person is recognizable.
Some personal data is directly about someone (direct personal data). In addition, there are data that are not directly about someone, but can be traced back to that person (indirect personal data). These are data that, in combination with other data, say something about a person. For example, the IP address of someone's smartphone.
The following data are not personal data according to the AVG:
data on organizations (legal entities);
data of deceased persons.
That means the AVG does not apply to this data. Unless the information also says something about a (natural) person.
Information about a legal entity can also say something about a natural person. For example, as:
the name of the legal entity is derived from the name of a natural person;
a company's e-mail address is used only by a specific employee;
information about a small business also says something about the owner's behavior.
In such a case, it does constitute personal data. And the AVG applies to them.
Information about a deceased person can also say something about a living person. For example, in the case of a hereditary disease. Then it is personal data of the living person. And the AVG applies to that.
This can come into play, for example, with a family tree on the Internet. Does it list the diseases from which people died? Then that information can also apply to the next of kin. And that information may only be published on the Internet if the next of kin have given permission. See further: Removing data from a website.
The AVG distinguishes between "ordinary" and "special" personal data (the literal term in the AVG is: "special categories of personal data").
Special personal data is data that is so privacy-sensitive that it could have a large(er) impact on someone if processed. That is why special personal data are given extra protection in the AVG. This is stated in article 9 AVG.
The AVG considers these personal data to be special personal data:
personal data revealing a person's racial or ethnic origin;
personal data revealing a person's political views;
personal data revealing a person's religious or philosophical beliefs;
personal data showing union membership;
data about a person's health;
data about a person's sexual behavior or sexual orientation;
genetic data;
biometric data (intended for the unique identification of a person).
Genetic personal data provides unique information about a person's physiology or health and/or the health of family members. This is what makes the information so sensitive. In practice, this mainly involves information about heredity and genetic characteristics that is the result of a biological sample. For example, information from analysis of DNA.
Biometric personal data provide unique information about a person's physical, physiological or behavioral characteristics. This is what makes the information so sensitive. In practice, this mainly involves biometric personal data that is the result of specific technical processing, making the data traceable to an individual. As in the case of fingerprints.
Criminal data are not special personal data according to the AVG. However, special rules apply rules for the processing of criminal data.
A national identification number is also not special personal data under the AVG. But EU member states are allowed to set their own conditions for processing such a number. In the Netherlands, this is the citizen service number (BSN). The AVG Implementation Act (UAVG) contains rules for the use of the BSN.
The AVG explicitly states that special personal data and criminal data are so sensitive that they require special rules. But these are not all data that can be sensitive.
There are also data that are not explicitly named in the AVG as sensitive, but which have a greater impact on a person's privacy than ordinary personal data. We call these sensitive personal data.
Personal data generally considered privacy sensitive are:
data on electronic communications;
location data;
Financial data (such as income or buying habits);
the citizen service number (BSN).
Criminal data is data related to:
Criminal convictions and offenses. This includes both convictions and possibly well-founded suspicions. That is, there are concrete indications that a person has committed a criminal offense.
Security measures related to it. This refers to personal data related to a court-ordered injunction due to unlawful or nuisance behavior.
In the AVG, criminal data is called "personal data relating to criminal convictions and offenses. And in the UAVG, "personal data of a criminal nature.
Protection of privacy is a fundamental right. This right is regulated in:
Article 8 of the European Convention on Human Rights and Fundamental Freedoms (ECHR)
Article 7 of the Charter of Fundamental Rights of the European Union
Article 17 of the International Covenant on Civil and Political Rights (ICCPR)
In addition, in Article 8 of the Charter includes an explicit right to the protection of personal data.
These articles indicate that there must be a law for the protection of personal data. So that everyone's right to privacy is guaranteed. In the Netherlands, that law consists of the AVG and the UAVG.
Source: https://www.autoriteitpersoonsgegevens.nl/themas/basis-avg/privacy-en-persoonsgegevens/wat-zijn-persoonsgegevens, accessed April 11, 2024.
