Personal Data and Processing

The Scope of the GDPR

The General Data Protection Regulation (GDPR) is a European regulation that has applied since 2018. It applies to the processing of personal data carried out by organizations established in the European Union, and to certain organizations outside the EU that target people located in the Union. For a data or product team, this is not a subject reserved for lawyers: most design decisions (which data to collect, how long to keep it, who has access) have direct consequences under the GDPR.

This course presents the established principles of the GDPR for data and product teams. It does not replace the advice of your data protection officer (DPO) or your legal department, nor the recommendations published by the supervisory authority (the CNIL in France).

What Is Personal Data?

Personal data is any information relating to an identified or identifiable natural person. Identification can be:

• direct: name, first name, photo, personal email;
• indirect: customer number, phone number, IP address, cookie identifier, license plate, geolocation data;
• by cross-referencing: “woman, 42, finance director, Quimper branch” can designate a single person without naming them.

The criterion is the reasonable possibility of identifying the person, by the organization or by a third party, with the means available to them. Data relating to companies (company name, revenue) is not personal data, but the personal email of an employee of that company is.

What Is Processing?

Processing is any operation performed on personal data: collection, recording, organization, storage, consultation, modification, cross-referencing, transmission, erasure. A CSV export, an SQL query on the customers table, sending a file to a service provider, training a model on customer histories: these are all processing.

Two main actors:

• the controller determines why (purposes) and how (essential means) the data is processed. This is generally the company, not a particular employee;
• the processor processes the data on behalf of the controller and on its instructions: hosting provider, SaaS vendor, email-sending provider (lesson 5).

Special Categories of Data

Certain data, known as sensitive, benefits from enhanced protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, health data, sex life or sexual orientation. Its processing is prohibited in principle, except for exceptions provided by the text (explicit consent, employment law obligations, etc.). Data relating to criminal convictions and offences is also subject to specific regulation.

Beware of data that is sensitive by inference: a history of purchases at a pharmacy or of gluten-free products can reveal health information.

Pseudonymization and Anonymization

• Pseudonymizing means replacing direct identifiers (name, email) with a pseudonym (for example a random identifier), with the correspondence table kept separately. It is a good security measure, but the data remains personal: re-identification is possible.
• Anonymizing means making re-identification impossible in practice, irreversibly, even by cross-referencing. This is difficult: combinations of a few attributes (postal code, date of birth, sex) are often enough to single out a person. Aggregation (statistics by a sufficiently large group) is a common technique.

Only truly anonymous data falls outside the scope of the GDPR. When in doubt, consider it personal.