Processing, anonymization and pseudonymization of personal data

The processing of personal data covers any operation or set of operations performed on personal data, or a group of personal data, such as: collecting, recording, organising, structuring, storing, adjusting or changing, withdrawing, consulting, inspecting, using, disclosure through transmission, publication or otherwise making them available, matching or combining, restricting, deleting and destroying. The processing of personal data can occur in two forms: automated and non-automated (manual).

Automated processing of personal data

Automated processing of personal data includes personal data operations that are performed in whole or in part in an automated manner (using a computer, mobile device, or other device).

Profiling

Profiling refers to any form of automatic processing of personal data, which consists of the use of personal data to assess certain personal aspects related to the natural person, and in particular for the analysis or prediction of aspects relating to the performance of the professional duties of that natural person, his economic condition, health, personal preferences, interests, confidentiality, conduct, location or movement.

Direct marketing

Direct marketing includes communication that is achieved in any way according to the latest technological advances, for the purpose of sending advertising, marketing or propaganda content (e.g. communication via email). Personal data processing for the purposes of direct marketing is allowed only if the consent of the personal data subject is obtained in advance. In addition, individuals must be empowered at all times to object to such use of their personal data (to have the opportunity to “opt out”), as well as to a profile to the extent that it is related to direct marketing. The right to “disconnect” must be free. Personal data subjects must also be informed of this right in a clear manner, separate from other information.

Non-automated (manual) processing of personal data

Non-automated (manual) processing of personal data covers the operations performed on personal data in a manual archiving system, i.e. through a specially structured paper file, which makes personal data available according to certain criteria. For example: If the employer keeps a paper file, entitled “Employee Absences”, which contains all the details of the absences used by employees in the past year in alphabetical order, such a file is a manual archiving system.

Collection of personal data

A personal data collection is a structured set of personal data that is accessible according to specific criteria, whether centralized, decentralized, or distributed on a functional or geographical basis.

Data anonymization

Anonymization is an operation by which all identifying elements are removed from a set of personal data so that the data subject can no longer be identified. When the data is successfully anonymized, it no longer belongs to the category of personal data and the rules for personal data protection do not apply to them. Such anonymized information may be further used for statistical or research purposes.

Data pseudonymization

Pseudonymization is an operation that allows personal data to no longer be associated with certain personal data entities without the use of additional information, provided that such additional information is stored separately and subject to technical and organisational measures to be taken, ensuring that personal data is not linked with an identified natural person or an identifiable natural person. Unlike anonymized data, pseudonymized data is still considered personal data, as information containing personally identifiable information, and is subject to the rules of personal data protection.

Exceptions to the rules on personal data protection

The rules of personal data protection do not apply to the processing of personal data for personal or domestic purposes. In the digital age, it is becoming increasingly difficult to determine which processing is personal or domestic.
For this purpose, auxiliary criteria are used, namely: Is personal data published to an unlimited number of people, or only to a limited group of relatives, friends or acquaintances? Does personal data also affect individuals who do not have a personal or domestic relationship with the person who publishes it? Is there evidence of a group of individuals acting together in a collective and organised way? Does the scope and frequency of personal data processing indicate a professional or work activity? Does it have a potentially negative impact on individuals, including intrusion into their privacy?

Also, the processing of personal data exclusively for journalistic purposes, or for the purposes of academic, artistic or literary expression is subject to derogation from certain provisions.

If you need legal help regarding personal data processing, click here to find out more.