Personal Data

Legal Framework

The right to protection of personal data is constitutionally anchored in Article 16 of the EU Charter, which empowers the EU legislature to lay down rules on the processing of personal data and its free movement. The operational core of this framework is the GDPR, whose Article 4(1) defines the material scope of protection:

This definition is deliberately broad, encompassing both directly identified individuals and those identifiable through identifiers such as names, location data, online identifiers, or factors specific to physical, economic, cultural, or social identity. Pseudonymised data remains personal data under Article 4(5), since re-identification is possible with additional information.

Once information qualifies as personal data, the processing principles in Article 5(1) apply in full: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security. Processing must additionally rest on at least one lawful basis under Article 6(1), whether consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests.

Key Developments

Enforcement decisions have sharpened the practical boundaries of what constitutes lawful processing of personal data. The Swedish DPA's decision against a school in Skellefteå illustrates the threshold for valid consent in sensitive-data contexts:

"consent can not be applied since students and their guardians cannot freely decide if they/their children want to be monitored for attendance purposes"
— Skellefteå school decision

The case involved facial recognition for attendance monitoring — biometric data triggering Article 9 — and the DPA found the measure disproportionate even though attendance monitoring itself can be lawful. The Baden-Wuerttemberg DPA similarly sanctioned a police officer who queried licence plate owner data without official cause, confirming that a valid legal basis for access does not authorise processing for unrelated personal purposes.

The Danish DPA's enforcement against IDdesign addressed storage limitation under Article 5(1)(e), where the company retained approximately 385,000 customers' data beyond the period necessary for the original purpose. The court reduced the fine based on the company's own turnover and mitigating factors, but confirmed the underlying violation.

Status of the Debate

The definition of personal data is settled in its core: any information relating to an identified or identifiable natural person falls within scope. What remains actively contested is the outer boundary — specifically, whether certain categories of data (dynamic IP addresses, hashed identifiers, device fingerprints) qualify as personal data in contexts where re-identification requires disproportionate effort. The CJEU's line of reasoning from Breyer through Schrems II suggests a context-dependent, risk-based approach, but courts diverge on how to weigh the means reasonably likely to be used for identification. No single post-GDPR ruling has definitively resolved this threshold question. A future CJEU reference on whether pseudonymised data in a specific technical configuration remains identifiable would provide needed clarity.

Practical Guidance

• Classify data at the point of collection. Determine whether each data element, alone or combined with others, can identify a natural person under Article 4(1). When in doubt, treat it as personal data.
• Anchor every processing operation in a specific lawful basis under Article 6(1). Document the basis at the time of collection and reassess it when purposes change.
• Apply data minimisation rigorously. The Skellefteå and AEPD CCTV cases confirm that even a valid purpose does not justify disproportionate data collection; choose the least intrusive means.
• Set and enforce retention deadlines. The IDdesign decision demonstrates that failing to establish deletion timelines — and failing to execute them — constitutes a standalone violation of Article 5(1)(e).
• Verify consent quality, not just existence. Consent must be freely given, specific, and revocable. In contexts of power imbalance (schools, employment), consent will likely fail as a lawful basis, as the Skellefteå decision confirms.