AVG series: (special) personal data
evavangroezen
What are personal data? And when do we talk about special personal data? You can read about it in this article.
data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQEAYAAABPYyMiAAAABmJLR0T///////8JWPfcAAAACXBIWXMAAABIAAAASABGyWs+AAAAF0lEQVRIx2NgGAWjYBSMglEwCkbBSAcACBAAAeaR9cIAAAAASUVORK5CYII=
Louwers IP & Tech Advocaten
As we wrote earlier, the General Data Protection Regulation ("AVG") came into force on May 24, 2016. The Personal Data Protection Act ("PDPA") provides for the protection of personal data until May 25, 2018, after which the AVG will take over.

The aforementioned legislation includes rules on the lawful processing of personal data. Processing of personal data soon comes into play, not only because processing is a broad concept, but also because more and more information is designated as legally relevant personal data.

What are personal data?

Personal data means any information about an identified or identifiable natural person. The information must be able to lead directly or indirectly (by means of inference) to the identification of a natural person.

Obvious personal data are a person's name, address, place of residence, Social Security number and (e-mail) address. Less obvious personal data are license plate information and IP addresses.

What is special personal data and what will change under the AVG?

More sensitive data such as a person's race, religion, sexual life, political opinion, health, trade union membership and criminal behavior are classified as special personal data in both the PDPA and the AVG, for which the law provides a high degree of protection.

The AVG made changes to the wording of categories of special personal data and expanded the categories of special personal data to include genetic data and biometric data.

Genetic data are explicitly established in the AVG as a category of special personal data. The sensitivity of genetic data, such as DNA, follows from the fact that it says something about the health status of a person and their family members.

Biometric data are included in the AVG as a category of special personal data insofar as they are processed for the purpose of uniquely identifying an individual. Biometric data include fingerprints, voice, handwriting, hand circumference geometry and scans of retina, iris and face. The sensitivity of these precise metrics stems from the fact that they contain unique body characteristics of a person. However, based on the above, a photograph of a person is not by definition special personal data. After all, special personal data only exists when the photograph is processed with the aid of certain technical means and thus makes it possible to uniquely identify a person. The importance of legal regulation of biometric data follows, among other things, from the developments in the use of biometrics as a means of identification to regulate access to certain places, buildings and information systems.

Why is the distinction between personal data and special personal data relevant?

The processing of special personal data is prohibited under both the Wbp and the AVG unless there is a statutory exception. An example of a statutory exception is explicit consent of the person whose personal data is involved. These and other statutory exceptions will be returned to later in the AVG series.

What do the changes in the AVG mean for the practice?

It is important for organizations to realize that personal data is accompanied by legal rules aimed at ensuring that lawful processing takes place. Moreover, when the AVG finally takes effect next year, because of the expansion of the categories of special personal data, organizations will have to be even more alert than they are now with the processing of special personal data. As a result, business processes related to the processing of personal data may have to be adjusted in the run-up to May 25, 2018. It is therefore wise to take stock in good time of what personal data your organization processes, whether it qualifies as special personal data and whether the processing of this personal data is based on a legally valid basis.

Contact us without obligation