What do a grocery purchase, a social media “like,” and a reading from a wearable have in common? Each can become data about you. Personal data is information relating to an identified or identifiable person. It can include records you provide deliberately and traces of everyday activity that organizations collect and hold. section 3.2 section 6.5.3 section 8.4.3
That data may sit with social media companies, shops, healthcare services, lenders, and governments. Who holds it matters: a UK study found greater trust in the NHS and local doctors than in social media companies. Many people were open to exercising information rights but did not know how. section 3.2 section 8.4.3
Two questions help when deciding how data should be used:
- Should it be open? Sharing data can generate insights, but personally identifiable information is excluded from the Open Data approach described here. Predictive analytics teams may ask for identifying information to be removed before they receive a dataset. section 6.5.3
- Does removing a name protect identity? Not necessarily. A discussion of DNA records found that stripping names and other details met a legal requirement, while a complete genome could still identify a person. section 1.2.1
Proposals for greater individual control include connecting accounts through a data intermediary to manage access, deletion, and use. Such control depends on laws being enacted and enforced; it is not a right to assume everywhere. Another proposal is a data dividend from licensing personal data, but the amounts discussed are estimates, not promised income. A useful first step is to notice which organizations hold data about you, then decide what questions you want to ask about its use. section 8.4.3 section 8.7.1 section 3.2
