A person is identifiable if one can derive the specific person the data is about through the information given. This includes:

• Persons that are identifiable through the use of a non-technical identifier, e.g. social insurance number.

  • If a database record has a unique identifier (e.g. random UUID or a automatically generated sequence number) that has no meaning outside of the system, it is irrelevant.

  • Seldom special case: if the technical identifier is somehow built in a non-anonymous way that allows guessing the person’s technical identifier with a fairly good chance (e.g. because there is a specific order in which the records are created or the number combines actual information on the person, it may no longer be considered just a technical identifier.

• Persons that are identifiable through a combination of data fields on the subject.

  • This includes both data on the person actually stored in the system under examination (e.g. like surname, first name and birthdate) and other data sources that can be assumed could be available to an attacker.

  • Thus using the social security number and not storing any name or other information on the subject in the system is technically speaking a mean to pseudonymise data, but not from the functional point of view, since the social security number is stored with the additional data in so many other systems (federal statistics, communal registers, employer HR systems, private und public insurances etc.) that it must be assumed that an attacker may be able to identify a specific person behind the social security number.

  • Do not just consider direct approaches to identify the person (e.g. email address or combination of names, birthdates etc.), but also statistical approaches. E.g. if the system shows a report how each group of users filed a yes/no-vote on an sensitive example subject and the sex (male/female) of each person is known to the system, consider whether it could be that there are specific users groups that could only include one male (or female) by accident. Thus if it would be known that all males voted “yes” and it is obvious, that only one person in the user group could have voted “yes”, the person becomes identifiable. It is enough to consider the data to be person identifiable even if only a sub-group of persons can be identified through statistical means and others remain anonymous.

If above mechanisms do not allow to identify or attribute data to a specific person (=anonymous data), the data is not considered personal data at all by the data protection acts even if it is data about people in general. E.g. a list of the most popular baby names is not personal data. Only once data can be attributed to a specific person, it becomes personal data.