Math Matters
Court Holds that Math Matters for eDiscovery Keyword Search, Urges Lawyers to Abandon their Fear of Technology
August 16, 2018
Navigating Stormy Social Media Discovery
Safely Navigating the Stormy Seas of Social Media Discovery
August 23, 2018

GDPR: What Is Personal Data?

GDPR: What is personal data
This post is the third of a series of short blog posts about GDPR. Click here to go to the first blog post

The GDPR only applies to Personal Data, which is defined in Article 4:

‘[P]ersonal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Use of the word "only" in this context is clearly understated. Personal Data is an extremely broad category. It covers any data about an identifiable natural person. It is important to note that this is significantly broader than the concepts of PII or even PHI in the U.S.. In contrast, the GDPR provides that personal data is literally any data about an identifiable person. We previously examined in the Driven blog Who is covered under the GDPR.

The GDPR does not encompass all data about a person. There are a few exceptions, the most important of which in this context is Recital 14, which carves out a specific exception for data pertaining to “legal persons.” A legal person, by contrast to a natural person, is a legal entity. Complicating matters for data analysis is the fact that a legal person and a natural person can be the same person and have significant identifier overlap. A sole proprietorship is a classic example of this scenario. Identifiers for Jane Q. Smith’s law practice may include her name, her phone number, and her office address. Or they could include her home address if she works from a home office.

Whether data is related to a natural person or a legal person can be an area of uncertainty that requires specific contextual analysis.

Jonathan Swerdloff
Jonathan Swerdloff
Jonathan Swerdloff is a Consultant at Driven, Inc. Prior to joining Driven, Jonathan was a litigation associate at Hughes, Hubbard & Reed LLP, accumulating more than 10 years experience in eDiscovery that included managing large discovery projects, analysis of enterprise systems, and investigations into nontraditional data sources. Through his experience as a litigator and programmer, Jonathan focused primarily on creative problem solving with regard to all data types. He analyzed and produced complex enterprise systems and developed internal workflows for large litigations. He deployed Information Governance strategies, has extensive experience with structured data collection, analysis, and production, and has served as an expert witness. His experience also includes developing cost-saving legal processes, managing legal budgets, and supervising legal personnel. Jonathan is admitted to the bars of New York and Connecticut. He holds a J.D. from the Cardozo School of Law and an MPS from NYU’s Tisch School of the Arts Interactive Telecommunications Program, where he studied rapid prototyping and software development. Jonathan is also an adjunct professor at the Parsons School of Design, teaching a Masters-level course in regulatory and ethics contexts for product designers. Jonathan previously served as the Director of Legal Strategy at the Corporate Knowledge Strategies Forum