How personal is personal?

The Register is reporting that the ICO wants a clearer definition of what consititutes 'personal data' - and it is indeed a crucial question, particularly under the current data protection regime. The issue has come up in the ICO's response to the Government consultation on the review of the Data Protection Directive - and one of the key points is that there is a difference between how personal data is defined in the directive and how it is defined in the UK Data Protection Act. That difference gives scope for lots of legal argument - and is one of many factors that help to turn the data protection regime from something that should be about rights and personal protection into something often hideously technical and legalistic. The ICO, fortunately, seems to recognise this. As quoted in The Register, ICO Deputy Director David Smith says:

"We need to ensure that people have real protection for their personal information, not just protection on paper and that we are not distracted by arguments over interpretations of the Data Protection Act,"

That's the crux of it - right now, people don't really have as much real protection as they should. Will any new version of the directive (and then the DPA) be any better? It would be excellent if it did, but right now it's hard to imagine that it will, unless there is a fundamental shift in attitudes.

There's another area, however, that just makes it into the end of the Register's article, that may be even more important - the question of what constitutes 'sensitive personal data'.  Here, again, the ICO is on the ball - this is again from the Register:

"The current distinction between sensitive and non-sensitive categories of personal data does not work well in practice," said the submission. "The Directive’s special categories of data may not match what individuals themselves consider to be ‘sensitive’ – for example their financial status or geo-location data about them."

The ICO go on to suggest not a broadening of the definition of sensitive personal data, but a more 'flexible and contextual approach' to it - and they're right. Data can be sensitive in one context, not sensitive in another. However, I would suggest that they're not going nearly far enough. The problem is that the idea of the 'context' of any particular data is so broad as to be unmanageable. What matters isn't just who has got the data and what they might do with it, but a whole lot of other things concerning the data subject, the data holder, any other potential data user and so on.

For instance, consider data about someone's membership of the Barbra Streisand fan club. Sensitive data? In most situations, people might consider it not to be sensitive at all - who  cares what kind of music someone listens to? However, liking Barbra Streisand might mean a very different thing for a 22 year old man than it does for a 56 year old woman. Extra inferences might be drawn if the data gatherer has also learned that the data subject has been searching for holidays only in San Francisco and Sydney, or spends a lot of time looking at hairdressing websites. Add to that the real 'geo-tag' kind of information about where people actually go, and you can build up quite detailed profiles without ever touching what others might consider sensitive. When you have all that information, even supposedly trivial information like favourite colours or favourite items in your Tesco online shopping could end up being sensitive - as an extra item in a profile that 'confirms' or 'denies' (according to the kinds of probabilistic analyses that are used for behavioural profiling) that a person fits into a particular category.

What does all this mean? Essentially that ANY data that can be linked to a person can become sensitive - and that judging the context is so difficult that it is almost impossible. Ultimately, if we believe that sensitive data needs particular protection, then we should apply that kind of protection to ALL personal data, regardless of how apparently sensitive it is....