Could some please explain sensitive data...?

[Koldov]

Looking for a simple explanation (if there is such a thing with GDPR)...

 

Just taken an online course (5 minute thing) on the very basics of GDPR.

 

There was a quick set of questions that I felt fairly confident completing.

 

I got this one wrong!

 

 

Apparently telephone numbers, names, addressess, email address, CCTV, photographs and voice recordings are not sensitive data?!

 

 

Can somebody please give me any reasoning behind this?

[rom1984]

Its the wording of the questions that is some what wrong. Sensitive data is an old DPA98 term. The correct terminology that they are trying to ask about is special category data.

 

Telephone numbers, name, email address etc is personal data.

 

race, ethnic origin, health, biometrics, sex life, sexual orientation trade union membership, religion and politics can also be personal data but is classed as special category data.

 

Special category data is usually more sensitive than "normal" personal data. As such the GDPR says you need to satisfy a special condition under Article 9 as well as your usual lawful basis for processing. It also requires more protection than personal data because there is a greater risk in processing it.

 

The question should say what is special category data.

Edited September 5, 2019 by rom1984

[AndyCrow]

If you need any more clarification the following link is from the ICO website

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/

[Techie2000]

Apologies, I may be taking this thread on a wild tangent but based on the information above I have a query about the legality of certain information disclosures of special category data.

 

I work for a local authority maintained school and have to sort through an abundance of paperwork and files etc. which should be dealt with by those above my pay grade (that's an argument for another day!). Upon going through some HR spreadsheets, sent through from our LA HR & Payroll department, there was information regarding salaries and deductions. I was quite dumbfounded to see that the deductions information clearly informed of those staff in a union, which union and how much they paid to their union.

 

Is this legally allowed? Upon signing up to a union, I did so in confidence and privacy due to issues in the workplace and noticed a change in behaviour within our SMT as soon as my next payday came along - the reasons for which are now blatant. Is this something that can be/ should be disclosed by the payroll department?

[cw222]

Would this be useful for you? : https://www.gov.uk/government/publications/payment-of-union-subscriptions-through-check-off ; https://www.nidirect.gov.uk/articles/trade-union-subscriptions

 

I think it depends on how you pay for your union membership, if you are paying by "check off" it will come out of your pay, I imagine if you pay by direct debit this would be the most private way to pay. It's a good question though!

[PotNoodleTech]

I am not an expert.

 

Think of it as to whether the data should remain private or not - what they call sensitive data is data that should be kept private at all times, no one else should know that data other than you and someone who you have agreed to process that data with.

 

The other category you ticked, name, address, telephone, email, cctv (arguable) is personal data, yes, but it is not sensitive data as you give it out to people all the time, for example do you have your name and a photo on your staff ID badge? you are broadcasting that to everyone you see on a daily basis, you give your email address out and address and telephone number all the time.

 

Thats the way I look at it - ask yourself, would you want this data available for people/companies to see/use on a daily basis - if no then it's probably sensitive data.

[AndyCrow]

Without knowing all of the details here my take. Union Membership falls under Special Category data under GDPR.

GDPR states "You must still have a lawful basis for your processing under Article 6, in exactly the same way as for any other personal data. The difference is that you will also need to satisfy a specific condition under Article 9." (see link)

 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/

 

In other words there has to be more than one reason to process the data. So the question in my my mind is whether the HR company needs to specify why there are deductions, ( they should be able to explain their lawful basis for that) but I would certainly query why they have mentioned which Union. This seems unfair.

 

Once they have sent the spreadsheet to the school this sensitive data needs to be protected. Processes should be in place restricting access to the docs and you should ask to see these. ( If they were in place you wouldnt have seen it!). it could be argued that the Head and Head of Finance could see the details but certainly not the entire SMT. If they wanted to know the number of Union members in the school for example this data could be anonymised.