What is personal data?

Article 6 (1) 1 of the Act of August 29, 1997 on the Protection of Personal Data expressly provides a definition of what should be understood by personal data. The provision states that personal data is any information relating to an identified or identifiable natural person. Here, an apparently simple provision should be clarified, which may, however, raise doubts.

Personal data and the possibility of identification

The next paragraph of the article quoted in the introduction explains that an identifiable person is a person whose identity can be identified directly or indirectly, in particular by reference to an identification number or one or more specific factors determining his physical, physiological, mental, economic and cultural characteristics. or social. Note that this directory is not a closed directory. Therefore, when deciding whether the data we identify belongs to the group of personal data or not, it is necessary to analyze the situation in a broader context. To do this, you need to approach the problem in an individualized way, assess the situation taking into account specific circumstances, connections between them, and even the selected means or method needed to make this identification.

Which data is personal data?

Based on the definition provided by the legislator, it should be assumed that the information constituting personal data is undeniably the name and surname, address of a given person - street, house number, town or e-mail address that can be assigned to a specific person. The PESEL number is also this category of data classified as personal data, because the first six digits indicate the date of birth (year, month, day), the next four - the ordinal number and gender of the person, and the last one is a check digit used to electronically check the correctness of the registration number given.

It can therefore be concluded that all the above-mentioned categories of data constitute personal data, and their processing is subject to all the rigors provided for in the Personal Data Protection Act.

What data is not personal data?

Personal data will not be single pieces of information that are very general, such as the name of the street and house number or the amount of remuneration. However, this information will constitute personal data when it is combined with other additional information that can consequently be related to a specific individual.

Art. 6 sec. 3 of the aforementioned Act indicates that if, in order to obtain information on the basis of the provided data, we want to determine the identity of a person, and this requires excessive costs, time and activities, such information is not personal data. The identification of a person must not require unreasonable, disproportionately large costs, time or activities. If so, the data does not constitute personal data. Therefore, they will be both such data that allow the identity of a specific person to be determined and those that do not allow for its immediate identification, but are, at a certain cost, time and effort expense, sufficient to establish it, especially with the use of easily accessible and commonly available sources.

Example 1.

Is the city card number itself a personal data?

Yes, but only if on its basis it is possible to determine the identity of the person to whom this card belongs without excessive costs, time and effort.

Example 2.

Can an ambulance service (Healthcare Institution) refuse to issue medical records for a deceased family member?

Yes, if the deceased did not authorize any family member to issue his medical records during his lifetime.