Personal data
Personal data is any data pertaining to an identified or identifiable natural person. This means that such information directly concerns someone or can be traced back to that person in combination with other data. The fact that a natural person must be involved means that data concerning a deceased individual or an organisation does not constitute personal data.
Examples of ordinary personal data are names, addresses, postcodes, telephone numbers, and email and IP addresses.
Special categories of personal data
The legislation draws a distinction between special categories of personal data and ordinary personal data. Special categories of personal data refers to any data which is so sensitive that its processing may seriously infringe on someone’s privacy and could lead to discrimination. An organisation may not use any special categories of personal data, unless the law provides for an exception. In addition, it may only be processed subject to very strict conditions.
Special categories of personal data relate to:
- health;
- race or ethnic background (this includes a passport photograph on any proof of identity);
- political opinions;
- religious or philosophical beliefs;
- membership of a trade union;
- someone’s sex life or sexual orientation;
- genetic data;
- biometric data with a view to the unique identification of a person (e.g. an iris scan or a fingerprint).
Criminal convictions and punishable offences are also protected under the GDPR. The conditions governing their processing are even stricter than special category data.
Although the GDPR does not mention the citizen service number (BSN) as a special form of personal data, we nevertheless consider it to be so.
Sensitive personal data
Special categories of personal data are sensitive by definition. There are other types of personal data that have a larger impact on privacy than ordinary personal data. Examples of these types of sensitive data are assessments and financial information such as salary and bank account details.