← Back to catalogue
Research draft

personal data

vr.tr.personal-data · XCT.QLT

Let an agent explain what counts as personal data, individual rights and organisational duties in general terms, help people exercise their rights and respond to breaches, and refuse to expose or compile personal data about individuals.

Thing Registry Cross-cutting context

Research draft, second pass

A second pass drafted this model: the structure a model of this thing needs, and what is known about it in the world. The line under this one says how the second half was obtained - researched against sources, or recalled without web access, in which case nothing here was read anywhere and every claim is a lead to verify. Unreviewed either way.

written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify

Researched by: Claude

Purpose and description

Let an agent explain what counts as personal data, individual rights and organisational duties in general terms, help people exercise their rights and respond to breaches, and refuse to expose or compile personal data about individuals.

Any information relating to an identified or identifiable living person, such as names, identification numbers, location data, online identifiers and factors specific to a person, including special categories such as health, biometric and genetic data; called personally identifiable information in some jurisdictions and protected by data protection law.

What it is for: Protecting privacy and governing data use.

It can be decide whether information is personal data; exercise rights such as access and erasure; respond to a data breach; apply data minimisation in projects.

Distinguishing features

Relates to an identifiable person

Includes indirect identifiers

Special categories need extra protection

Regulated by law

What it looks like

Not physical; records, files, databases and online identifiers about people.

How it is recognised

Names, IDs, locations, identifiers

Special categories such as health data

Truly anonymous data falls outside personal data rules

Related models

is a kind of - category

private data

is protected by - law

data protection law

includes - example

biometric identifier

is held in - with safeguards

archives

In practice

Families and kinds

identity and contact data

online identifiers and location data

special category data

biometric and genetic data

protected health information

Standards and regulation

EU General Data Protection Regulation

Council of Europe Convention 108+

Sector laws such as HIPAA

Failure modes and hazards

Data breaches and identity theft

Doxxing and stalking

Re-identification of pseudonymised data

Also called

deed of change of namepersonally identifiable informationsensitive personal datacatamnesisprotected health informationbiometric identifiercriminal recordKundschaftsbriefenational identification numberloginsocial profilingBrazilian identity cardextended certificate of good conductEuropean Certificate of Good Conductpersonal identification numberregistration number of the taxpayer’s account cardFayda Digital IDCPR numberPESEL numberPersonal Identification NumberSocial Security numberFødselsnummer (Norway)

Where this came from

wikidata · CC0 1.0

Source repository Registry entry point

Drafted structure

Bundle to layer to finding to question, as the second pass will find it: 4 bundles · 8 layers · 8 findings · 16 questions.

Scope What counts.

Definitions matter.

Test

Is it personal data.

Test

Identifiability.

  1. Could this information identify a person directly or indirectly? boundary
  2. Is it anonymous or only pseudonymised? boundary

Special

Sensitive categories.

Special

Special categories.

  1. Does it include health, biometric, genetic or other special category data? boundary
  2. Which extra conditions apply? provenance
Rights Individual rights.

People have rights.

Access

Access requests.

Access

Access requests.

  1. How can someone request a copy of their personal data from an organisation? action
  2. What deadline applies? provenance

Erasure

Deletion and objection.

Erasure

Erasure and objection.

  1. When can someone ask for their data to be deleted or stop being processed? provenance
  2. How can a complaint be made to the regulator? action
Breach Data breaches.

Act quickly.

Victim

Affected people.

Victim

Affected people.

  1. Has the person been told their data was exposed in a breach? boundary
  2. Which steps protect them, such as changing passwords and alerting their bank? action

Organisation

Duties.

Organisation

Organisational duties.

  1. When must an organisation notify the regulator and individuals of a breach? provenance
  2. Who is the data protection officer? provenance
Limits Agent conduct.

No exposure of individuals.

Doxxing

Exposing people.

Doxxing

Doxxing.

  1. Does the request seek to find or compile personal data about a private person? boundary
  2. How should the agent decline? action

Design

Privacy by design.

Design

Privacy by design.

  1. How can this project minimise personal data and assess risks? action
  2. Is a data protection impact assessment required? provenance

What the second pass must settle

  • Should special categories be separate entries?
  • How should national laws be linked?
  • How should re-identification risks be recorded?
Draft as JSON