Personal data are all data about a person. This includes names and addresses, but also data such as IP addresses, bank account numbers, origin or orientation.
Processing personal data
Processing personal data includes collecting, storing, consulting, changing, sending and distributing. When you invite people to complete a Qualtrics survey, you will likely process personal data, probably without your being aware.
“Regular“ Personal Data
Before you can process any personal data a legal basis (in dutch) must be satisfied.
Sensitive Personal Data
Sensitive Personal Data are sensitive data such as:
- Data revealing racial or ethnic origin;
- Political opinions;
- Religious or philosophical beliefs;
- Trade-union membership;
- Health-related data;
- Data concerning a person’s sex life or sexual orientation;
- Genetic data;
- Biometric data processed solely to identify a human being;
- Criminal history;
- Citizen service number (in dutch: Burgerservicenummer (BSN))
“Regular” personal may be sensitive as well
Personal data that are not considered as sensitive may still be sensitive in nature. This is the case when it could have major consequences for those involved when the data leak. The subjects may, for example, become victims of (identity) fraud or other forms of misuse of their personal data.
The amount of sensitivity depends on the context in which they occur. These data also require extra protection.
Some examples:
- Subjects under 16 years old
They are less able to estimate the risks of data processing and therefore they cannot grant legal permission. Parental permission is required. - Data covered by professional secrecy (such as medical professional secrecy), data from DNA databases, data subject to a special, legally determined confidentiality obligation
- Data from people from vulnerable groups
E.g. people who are being stalked or who stay in a women’s shelter, whistleblowers or informers of the police or the Public Prosecution Service. - Data that can lead to stigmatization or exclusion of the person concerned
This includes, for example, information about gambling addiction, performance at school or work or relationship problems. - Information about the financial or economic situation of those involved (eg about debts)
- Log in names, passwords
- Data that can be misused for (identity) fraud (eg copies of identity documents, Citizen service number (in dutch: Burgerservicenummer (BSN))
Identifiability
With data such as name, address or date of birth someone can be identify in a drect way. A person can however be identified indirectly, for example by:
- a combination of datasets, like:
- pseudonyms such as respondent numbers and the key file
- dataset and consent form
- by spontaneous recognition when there is a unique or rare combination of certain data.
The chance of identification must be kept as small as possible.