What is the Difference Between Personal Data and Sensitive Personal Data?

|
|
PUBLISHED on
22
July
2022

There is some confusion about the difference between personal data and sensitive personal data and even whether sensitive personal data exists as a term!  So, let’s see if we can clarify the situation.  Under the old 1998 version of the Data Protection Act (DPA), there was a term ‘sensitive personal data’.  Under the GDPR, this is now known as ‘special category personal data’, so we are now concerned with two categories of personal information i.e., personal data and special category data.

Personal data

The GDPR defines ‘personal data’ as any information relating to an identified or identifiable natural person (‘data subject’).  At first glance, this is a simpler definition when compared to the definition of personal data in the DPA 1998.  However, in effect, the GDPR definition brings a series of identifiers into play including name, online identifiers (such as an IP address) and location data.

Under the GDPR, personal data only includes information relating to natural persons who:

  • Can be identified, or who are identifiable, directly from the information in question; or
  • Can be indirectly identified from that information in combination with other information.

With the DPA 2018, however, the definition refers to identified or identifiable living individuals and goes on to clarify an ‘identifiable living individual’ as being a living individual who can be identified directly, or indirectly, in particular by reference to:

  • An identifier such as a name, an identification number, location data or an online identifier, or
  • One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(Note the word ‘natural’ rather than ‘living’ was used in the GDPR to aid the translation of the term into multiple European languages).

Special Category Data

Special category data, by its very nature, is more sensitive, and so needs more protection. For example, information about an individual’s:

  • Racial or ethnic origin, political opinions, religious or philosophical beliefs
  • Trade-union membership
  • Genetic data, biometric data processed solely to identify a human being
  • Health-related data
  • Data concerning a person’s sex life or sexual orientation.

Under the GDPR, inclusion of genetic and biometric data is new.

In the UK, special category data previously included information about criminal convictions and alleged criminal offences – this is now treated separately, and its processing is subject to even tighter controls.

But why is it important to recognise the difference?  Of course, any category of personal data can be ‘sensitive’ for an individual, but special category data receives additional protection under the legislation.  Firstly, all categories of personal data can only be processed lawfully if certain conditions are met and the processing must, in all cases, be necessary.  These conditions, commonly known as ‘lawful bases’ are set out in Article 6 of the GDPR and there are 6 to choose from.

If the type of personal data processed falls into the special category data group, its processing is prohibited unless a second condition (set out in Article 9) is also met, or an applicable exemption can be applied.  Understanding the definitions is vital, as the processing of special category personal data is also subject to additional conditions, safeguards and exemptions set out in Schedule 1 of the DPA 2018.

So, first and foremost, whether the personal data is sensitive or not, you need to understand what categories of personal data you want to process, how and why.  Then, before you begin, you need to determine your lawful basis conditions for processing both categories and ensure you have documented your decisions.

Do you need assistance in improving your GDPR compliance position?

URM can offer a host of consultancy services to improve your DP policies, privacy notices, DPIAs, ROPAs, data retention schedules and training programmes etc.
Thumbnail of the Blog Illustration
Data Protection
Published on
14/12/2023
Information Commissioner’s ‘Today’ Interview 13/12/23

URM discusses an interview with the Information Commissioner, John Edwards, and the background of the penalty fine imposed on the Ministry of Defence (MOD).

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
22/7/2022
Verifying the Identity of Someone Requesting Information Under the GDPR

We look at the requirement within both the DPA and the GDPR to verify the identity of an individual making a request before acting or releasing information

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
30/8/2024
The ICO Issues its First Notice of Intention to Fine a Data Processor

URM’s blog explores the first provisional monetary penalty imposed by the ICO exclusively on a data processor & the lessons that can be learned from the case.

Read more
It’s one thing having the required technical knowledge, it’s another thing for a consultant to apply that knowledge to the context of our organisation. To use a sporting analogy, we view cyber and information security as a marathon not a sprint. I am not a believer in doing everything all at once. Our approach has been risk based and incremental, remediating our biggest risks first before moving on. I believe this approach is far more sustainable and effective. And URM’s consultants fully understand this and are very pragmatic and tailored in their guidance and advice. They know we are not implementing ISO 27001 purely for the certificate, but more as a framework for continual improvement, and at a pace where new systems and processes can be fully understood and absorbed by our team and be business as usual.
The Owners and Distributors of Quality Brands
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.