Data Processing Which Does Not Require Identification (Chapter 1, Section 9) — Guide to the GDPR

Upon the first reading of Article 11 GDPR, it may seem unintelligible and pointless. However, Article 11 GDPR plays an important role in the personal data protection system. It reconciles data protection and processing of unstructured data such as video surveillance, email, and even file servers, as well as the use of personal data for data analysis – creating profiles.

Article 11 concerns cases in which a particular activity at any given time does not require knowledge about whose personal data is processed. Situations of this kind arise when it can only be surmised that information for which an organisation is responsible contains personal data or in cases where it is certain that data of this kind are held, but it is not known precisely whose data these are or where exactly they are. Similarly, when we have anonymised data or if we received pseudonymised data without a key required for reidentification, we know we process personal data, but we cannot know whom they concern.

In practice, the processing of personal data which ‘we do not know’ (which we call here as ‘unidentified data’) occurs frequently, despite it was not addressed in any manner by the Data Protection Directive. Video surveillance (closed-circuit television) of public space consists of processing personal data (faces and behaviours) of unknown individuals. Content of a company’s electronic correspondence (stored on mail servers but also in specific mailboxes) contains personal data, but it is not known whose or how they are connected with a company’s activity. The same applies to file servers and any system in which ‘unstructured’ data, generally referred to as ‘content’, can be inserted. As a rule, visitors to websites are not identified by hosts even if cookies are placed in their browsers and they can be tracked further.

Particular individuals who place data in a company’s resources (save a file in a catalogue, send emails or even only place it in a company computer) may know (but do not necessarily know) what kind of data they are placing in a company’s resources. Does this mean that the organisation now has that information at its disposal? In practice the organisation does not control data of that kind.

A different situation arises when a company knows the identity of a person whose data are processed, but this information will not be needed in future. In this case, Article 11 GDPR supplements anonymisation. If a data controller seeks only general trends or profiles or statistics and is not interested in specific individuals, then anonymising data allows to rely on Article 11 to avoid unnecessary onerous duties otherwise resulting from GDPR.

Article 11 GDPR applies to situations of this kind.

Under Article 11(1) GDPR:

If the [1] purposes for which a controller processes personal data [2] do not or [3]

no longer require identification of the data subject by the controller, the controller [4] shall not be obliged to maintain, acquire, or process additional information [5] in order to identify the data subject for the sole purpose of complying with this regulation.

Article 11(1) GDPR, therefore, states that GDPR does not oblige a data controller to identify persons whose data that controller processes. A controller does not have to take measures to identify ‘unidentified’ persons just to satisfy GDPR. That is actually in line with the ‘necessary knowledge’ principle, i.e. principle of minimisation.

The purpose of data processing in email is to enable communication between users and between users and the outer world. Only a particular email might become important for a certain data processing purpose due to its content. In such a situation, the content should be accordingly catalogued or printed, and placed in a binder for the case, or copied into the case folder, or marked in the document management system (DMS). Of course, the DMS can be integrated with email system, and then an analysis of the purposes of data processing within email becomes more complex.

The situation regarding the storing of data on company computers, in shared resources and on private devices used for business, is similar. Even if the controller’s systems automatically index the content in those resources, this does not mean that the controller knows the identity of the persons mentioned in those resources. Only the posing of a specific question (search) regarding specific identifying data of a particular individual can provide it with that information.

The controller is required however to be aware of the structure of shared resources. If that structure relates to personal data, for example it mentions the case files of a particular natural person, then the content of that catalogue will, as a rule, be normal personal data relating to that person, and the controller will of course be able to identify them.

Article 11(1) GDPR states that if no information about whose data is processed is needed for the data processing purposes, their identity does not have to be determined. Therefore, there is no need to proactively monitor content that passes through controller’s systems solely to detect any personal data, in particular data concerning the identity of particular individuals.

As there is no obligation to identify individuals unless the data controller needs it, there is no need to monitor information resources solely to find out everything there is to know about particular individuals by analysing all of the information in a company’s resources. In general we may have a lot of material allowing us to learn a lot about specific individuals. Meanwhile, there is no obligation to analyse that material solely in order to ascertain the level of potential knowledge. Moreover, as we have mentioned above, from the point of view of privacy and the principle of minimisation, proactive monitoring of this kind could be considered excessive, and unlawful violation of privacy. This has major implications for the scope of data processing obligations.

Under Article 11(2) GDPR:

Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.

Under Article 11(2) GDPR there are two notification obligations:

Consequently, a controller does not have to ensure execution of other individual’s rights (data subject requests), except notification of processing (Articles 13 and 14 GDPR).

A controller has an obligation ‘where possible’ to inform an individual that they cannot be identified if the controller ‘is able to demonstrate that it is not in a position to identify the data subject’. This is enigmatic, as first there is the question of demonstrating that someone cannot be identified and second there is the question of how to inform somebody, if they cannot be identified. This might not be that complicated, however.

In the case of video surveillance, it is sufficient to display a notice stating that video surveillance is used in the area, of the wording required for the notification obligation under Article 13 GDPR, also stating that identification is not possible.

In internal conference call systems, information notices or messages screened before the call starts can also be used.

Where an anonymised or pseudonymised database is purchased for the purpose of research, creating profiles, etc. one can imagine that a controller might stipulate in the agreement with the seller of the database that the seller will inform the persons whose data are in the database of the data required under Article 14 GDPR and of the fact that they cannot be identified.

Similarly, where an electronic marketing services provider enables an online seller to send an offer to the email address of a visitor to that seller’s website, after verifying (e.g., using cookies) that the person gave a different entity consent to direct marketing of third-party products, in the same email the addressee can be informed of ‘unidentified’ processing of their data.

In the case of email, a controller that does not filter sent content is not able to determine en masse what is written and about whom. Under Article 11(1) GDPR, a controller is not required to filter content from the point of view of personal data. For this reason, it is not possible to communicate with people whose data are featured in the email.

The situation with regard to email addressees is different. A controller is not required to know whom the email is addressed to, but the recipient’s address will be retained in the email system. Therefore we may have a situation of processing ‘unidentified data’. The addressee may, however, be reached out (in the same email) to be informed about their data processing. What to do? Probably the easiest solution would be to assume all email addresses are identifiable (to avoid differentiating between emails such as isomuchlikelarrypage@gmail.com and satya.nadella@microsoft.com) and apply the layered approach to information obligation, described in the previous chapter, providing in an email footnote a basic info that XYZ Incorporate is a data controller of personal data consisting of sender’s and addressee’s email addresses and contained in the body of an email, that data are processed primarily to allow email communication and that more information can be found at www.privacypolicy.XYZ.com.

The last of the obligations of specific nature relating to ‘unidentified’ data is a return of the obligation to accommodate rights of individuals (Articles 15–20 GDPR), when the individual enables themselves to be identified. A situation of this kind might arise where somebody wishes to access data from video surveillance, to determine who scraped a car in a shopping centre car park. There might also be other circumstances. The important issue is that providing ‘additional information enabling identification’ of the person making the request does not mean presenting a personal identification card but giving details allowing specific information about the person making the request to be ‘tracked down’ in the files.

When processing ‘unidentified’ data, the same security obligations apply as in other cases. The risk to the rights and freedoms of persons whose data is processed needs to be analysed and appropriate security measures adopted. To achieve this, information about the identity of data subjects is not needed. One of the easiest organisational security measures in this respect might be to inform and require users who might place those ‘unidentified’ data in the controller’s resources to do this sensibly (e.g., not use company email for private purposes, not send material that violates people’s personal rights unless there is a legitimate reason).

Minimisation of unauthorised access to ‘unidentified data’ also has to be ensured. For example, conference calls should not be accessible by third parties (preventing unauthorised access is a security matter), and shared resources (intranet, Sharepoint, file servers) should be divided into zones according to needs and powers.

‘Unidentified’ data must also only be stored as long as necessary for the processing purposes. From this point of view, the practice of storing emails indefinitely, which happens in many companies, including some law firms seems unlawful. However long the period for which they are necessary might be, an indefinite period will exceed it.

#9.1 Preliminary Remarks

#9.2 No Need to Identify

#9.3 No Need to Monitor Unstructured Data

#9.4 Notification Obligations

#9.4.1 Obligation to Inform ‘Unidentified’ Persons That They Cannot Be Identified: Where Possible

#9.4.2 Enabling Execution of an Individual’s Rights

#9.4.3 Security

#9.4.4 Minimisation (Of Access and Retention)