Dear Kari Käsper,

I am preparing for the data protection exam and I am confused about some points we discussed in the lectures.

What is personal data out of these identifiers under GDPR:
1) Name
2) e-mail address Ourfamily@gmail.com
3) date of birth
4) ID code

As we discussed in the lecture and if I remember correctly, each one of these should not be considered personal data under GDPR on their own.

But in the correct context, especially when combined with other data, they can be considered personal data or so I gather from reading this article:

http://www.dataprotectionpeople.com/what-is-personal-data/

Quote from article: "Another example given by the ICO is, “a combination of data about gender, age, and grade or salary may well enable you to identify a particular employee even without a name or job title.”  Recital 26 of the Directive states that whether or not the individual is identifiable will depend on “all the means likely reasonably to be used either by the controller or by any other person to identify the said person”.  So in reality we may need to perform a reasonableness test in order to determine if any data or combination of data in a set of circumstances is to be classified as personal data."

Another quote from article: "In February 2014 a member of staff at the Bloomsbury Patient Network (an organisation providing information and support for people who are HIV-positive) emailed up to 200 patients who were HIV-positive.  The email addresses were entered into the “To” field, meaning they were visible to everybody who received the email.  In May 2014, the same member of staff repeated the error.  The ICO ruled that considering the subject matter of the email message the mistake was a serious breach of data protection laws."

If in the exam, when asked if these 4 identifiers are personal data under GDPR, I will mark these identifiers as personal data with a further explanation why I think they can be. Will I be correct?

Yours sincerely,
Kaspar Metsa