Chapter 19 — Privacy and data protection: scope and theory
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Scope of the law"]
N2["19.2 Identifiability"]
N3["19.3 Theory and law"]
N4["19.4 Beyond the law"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Scope of the law"]
N2["19.2 Identifiability"]
N3["19.3 Theory and law"]
N4["19.4 Beyond the law"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Scope of the law]
|
v
[19.2 Identifiability]
|
v
[19.3 Theory and law]
|
v
[19.4 Beyond the law]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) define the scope of data protection law; (2) relate theory to legal concepts; (3) understand where law ends and ethics continues.
19.1 Scope of the law
Elena studies the scope of the GDPR. It applies to processing of personal data by automated means or in filing systems, with exceptions such as purely household activities. Personal data means any information relating to an identified or identifiable natural person. The LGPD has a similar definition. Elena notes that pupil data clearly fall within scope, as do photographs and voice recordings in which children can be recognised. Article 4(1) defines personal data broadly. It covers any information relating to an identifiable person, including indirect identifiers.
19.2 Identifiability
Recital 26 explains that identifiability depends on the means reasonably likely to be used. Elena applies this to a published table of exam results for a small school. If a table shows that one pupil with free school meals achieved a certain grade, readers may identify the child. The data are therefore personal even though no name appears. She links this to the counting exercise in Chapter 6 and to Sweeney's research. Recital 26 sets the test. It asks what means are reasonably likely to be used to identify someone.
19.3 Theory and law
Elena compares legal concepts with privacy theory. The law's purpose limitation resembles contextual integrity's concern with flows matching contexts. Solove's harms, such as exclusion and secondary use, correspond to rights of access and purpose limitation. She notes that theory often explains why a legal rule exists, which helps staff understand and follow it rather than seeing it as arbitrary. Contextual integrity, for instance, explains why data shared with a teacher should not reach app advertisers, which matches the purpose limitation rule.
19.4 Beyond the law
Some practices may be lawful but still harmful. A school might lawfully share class photographs with parents, but a photograph showing a child in a distressing moment could cause harm. Elena writes that the trust should consider children's dignity and feelings, not only legal permissions. Dr. Asante agrees and notes that ethics continues where law is silent, especially for children who cannot easily speak for themselves. She adds an ethics question to vetting. Is this fair to the child? She asks it every time.
Worked example
Elena defines the GDPR's scope, shows how a small school's results table can identify a pupil, maps theory to legal rules and adds dignity as a consideration beyond the law.
Synthetic case. Examples are synthetic; GDPR Recital 26, the LGPD, Solove (2006), Nissenbaum (2004) and Sweeney (2002) are real.
Errors and limits
Identifiability is contextual; the same table may be safe for a large school.
Exercises
- EX055 — Personal data definition. What does personal data mean under the GDPR? Rubric: 3 = information relating to an identified or identifiable natural person;; 2 = close;; 1 = wrong;; 0 = none.
- EX056 — Nameless table. How can a results table without names be personal data? Rubric: 3 = small cells let readers identify a child;; 2 = mentions small numbers;; 1 = never;; 0 = none.
- EX057 — Lawful but harmful. Give an example of lawful but harmful processing from the chapter. Rubric: 3 = sharing a photo showing a child in distress;; 2 = example;; 1 = vague;; 0 = none.
Synthesis
Chapter 19 sets scope. Chapter 20 studies foundational cases.
Continue studying — chapter 19 of 40
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →