In ‘Opinion 4/2007’ on the concept of personal data, Working Party 29 (‘WP29’) identified four building blocks in the definition of personal data – ‘any information’, ‘relating to’, identified or identifiable’, ‘natural person’. They remained the same in the GDPR, thus rendering ‘Opinion 4/2007’ relevant for understanding the concept of personal data.
However, WP29, instead of eliminating all subjectivity to the extent possible, seemed to add some unclarity to the explanation of what ‘relating to’ means.
WP29 sets out that ‘in order to consider that the data “relate” to an individual, a “content” element OR a “purpose” element OR a “result” element should be present’. In turn, ‘“purpose” element can be considered to exist when the data are used or are likely to be used, taking into account all the circumstances surrounding the precise case, with the purpose to evaluate, treat in a certain way or influence the status or behaviour of an individual’.
By itself, an idea to decide on whether the data are personal or not through the interpretation of the “purpose” element is quite controversial due to the subjective (rather than objective) nature of the notion of purpose.
An example given by WP29 brings this problem front and center:
Passenger vehicles owned by a transportation company suffer repeated damage when they are dirtied with graffiti. In order to evaluate the damage and to facilitate the exercise of legal claims against their authors, the company organises a register containing information about the circumstances of the damage, as well as images of the damaged items and of the “tags” or “signature” of the author. At the moment of entering the information into the register, the authors of the damage are not known nor to whom the “signature” corresponds. It may well happen that it will never be known. However, the purpose of the processing is precisely to identify individuals to whom the information relates as the authors of the damage, so as to be able to exercise legal claims against them. Such processing makes sense if the data controller expects as “reasonably likely” that there will one day be means to identify the individual. The information contained in the pictures should be considered as relating to “identifiable” individuals, the information in the register as “personal data”, and the processing should be subject to the data protection rules, which allow such processing as legitimate under certain circumstances and subject to certain safeguards.
Most likely, it is only common sense that can lead to the conclusion that the purpose is to precisely identify authors of the graffiti. However, the controller can potentially argue that it keeps the register and images for some other internal purposes not connected with the purpose of future identification. As a result, we may end up being engaged in a discussion about true intentions of the controller which might not be established easily due to a lack of the factual grounds.
The issue described above may prima facie seem to be solely theoretical. Moreover, the language used by the GDPR contains various ‘floating’ criteria implying the necessity to conduct evaluations on a case-by-case basis. However, one should not overlook that, by applying the concept of purpose as described above, we decide on whether the data are personal or not, and a positive answer inevitably triggers set of responsibilities vested in the controller under the GDPR and Member States laws. It can be assumed that more certainty is need when addressing such a fundamental issue which may (or may not) trigger application of the data protection legislation in general.
Interestingly, the GDPR suffers from the same flaw like the WP29 ‘Opinion 4/2007’. Under Article 9(1), processing of biometric data for the purpose of uniquely identifying a natural person is prohibited (unless one of the exemptions under Article 9(2) applies). This brings us back to the issue of identification of the controller’s intention. Ironically enough, Recital 51 applies more objective criteria when addressing the same issue:
“The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person“
In other words, under Recital 51, it is ability of technical means to identify individuals that plays a key role (and not just purposes pursued by the controller). Unfortunately, this wording has been changed in Article 9(1) requiring to identify the subjective purposes (instead of objective abilities).
3 Replies to “A “purpose” element: what is inside the controller’s mind?”
Yes, I get what you mean. If the initial assessment is wrong, the nothing will be correct afterwards. In short ‘shit in’, shit out’ 😉
Good comment, Karen! “Can the toolbox provided by GDPR give some clarity on dealing with misuse/mis-interpretation in specific legal terminology” – I think, not always. I mean that all necessary measures, safeguards, paperwork, etc. that controller puts in place follow from controller’s initial legal assessment of factual setup. For example:
1) if controller believes that the data it processes is not personal – then it does not identify legal basis, does not perform its obligations under Article 13, 14, does not do any paperwork, etc.
2) if controller processes biometric data but denies having the purposes of unique identification – this, inter alia, will be reflected in the data inventory (Article 30.1.b).
In the examples described, I think, it is all about establishing the ‘true’ purposes. Not sure that GDPR toolbox may help a lot with this.
Do you think that there is more here if we were to try to demystify the ‘purpose’ definition in isolation? Can the toolbox provided by GDPR give some clarity on dealing with misuse/mis-interpretation in specific legal terminology? For example.
1. Is that the specific purpose is logged in a personal data inventory (Art 30) along with the legal basis (Art 6)
2. secondary use, e.g. payment data collected to buy a book (Purpose, legal basis contract Art 6.1a) will need to be retained for longer that the purpose requires in order to meet a legal obligation (Art 6.1c)
3. any use beyond this is not permitted, e.g. marketing
4. that a DPIA is conducted if there is any doubt as to the above and even the original purpose can present a risk to the rights and freedoms of the natural person.