Privacy and data protection: foundations and decisions

Chapter 1 — Privacy and data protection: foundations and decisions

Lesson map

Lesson 01 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The course and the case"]
  N2["1.2 What counts as personal data"]
  N3["1.3 Special categories"]
  N4["1.4 The principles"]
  N5["1.5 A first decision"]
  N6["Concepts — three different tests"]
  N7["Data — one slip, two layers"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The course and the case"]
  N2["1.2 What counts as personal data"]
  N3["1.3 Special categories"]
  N4["1.4 The principles"]
  N5["1.5 A first decision"]
  N6["Concepts — three different tests"]
  N7["Data — one slip, two layers"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[1.1 The course and the case]
    |
    v
[1.2 What counts as personal data]
    |
    v
[1.3 Special categories]
    |
    v
[1.4 The principles]
    |
    v
[1.5 A first decision]
    |
    v
[Concepts — three different tests]
    |
    v
[Data — one slip, two layers]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) define personal data and special category data; (2) name the GDPR and LGPD principles; (3) make a first, reasoned privacy decision in a small business.

1.1 The course and the case

Sofia Mendes, a pharmacy assistant, joins a one-month rapid course at the fictional Brightwater Community Learning Centre. Her mentor, Mr. Raj Patel, works as a data protection officer for several small businesses. Sofia's workplace is the fictional Juniper Pharmacy, a family business with three shops, about 9,000 regular customers, a prescription service and a new loyalty app. Pharmacies handle information about medicines, which can reveal illnesses, so even a small business carries serious privacy responsibilities from its first customer interaction. Sofia starts with her own shop.

1.2 What counts as personal data

Mr. Patel explains that personal data means any information relating to an identified or identifiable living person, under Article 4(1) of the GDPR; the LGPD in Brazil uses a similar definition in Article 5. A customer's name and phone number are personal data, but so is a loyalty number, because Juniper can link it to a person. Sofia lists examples from her shop: prescriptions, loyalty points, CCTV images at the counter, delivery addresses and notes about a customer's preferred pharmacist. Identifiability, not names, is the test.

1.3 Special categories

Some data receive extra protection. Article 9 of the GDPR lists special categories, including data concerning health, and the LGPD calls them sensitive personal data in Article 5(II). A prescription for insulin reveals diabetes; a purchase of pregnancy tests may hint at a pregnancy. Sofia realises that the loyalty app's purchase history could therefore contain health information even though it was designed for points and vouchers, not care. Processing such data needs a specific condition, not just an ordinary lawful basis. Pharmacies meet these daily.

1.4 The principles

Mr. Patel gives Sofia a one-page summary of the principles in Article 5 of the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The LGPD lists comparable principles in Article 6, including necessity and non-discrimination. For each principle, Sofia writes one sentence about Juniper. For minimisation she writes: the loyalty app should collect only what points and vouchers need. These sentences become her checklist for every later decision. Each sentence names one Juniper system, such as the loyalty app or CCTV.

1.5 A first decision

The owner asks Sofia whether staff may post a photo of the busy shop on social media, with customers visible at the counter. Sofia applies her checklist. The purpose is promotion, customers did not expect to appear online, and a pharmacy counter suggests health needs. She recommends taking photos only when no customers are present or with clear permission. Mr. Patel praises the reasoning: she identified the purpose, considered expectations and chose a simple alternative that still meets the business goal. The owner agrees.

Worked example

Sofia defines personal and special category data with pharmacy examples, writes one sentence per principle for Juniper and advises against posting counter photos showing customers.

Synthetic case. Brightwater, Juniper and all people are synthetic; GDPR Articles 4(1), 5 and 9 and LGPD Articles 5 and 6 are real.

Errors and limits

Definitions are broad; when unsure whether data are personal, treat them as personal.

Concepts — three different tests

Article 4(1) asks whether Juniper is dealing with a living person. Article 9 asks a second question, about health. The counter-photo decision in this chapter asked a third: would the person expect this use? Passing one test does not pass the others.

If Sofia cannot tell whether an item is linkable, she treats it as personal. That limit stays. It is not a reason to call the day's takings a customer record.

Data — one slip, two layers

Decision flow — classify before you decide the use

flowchart TD
  A["An item from the shop"] --> B{"Does it name a living person, or can Juniper link it to one?"}
  B -->|No| C["Not personal data, unless Sofia is unsure"]
  C --> D["If unsure, treat it as personal and stop the guess"]
  B -->|Yes| E["Personal data. The Article 5 checklist applies"]
  E --> F{"Does the content state a condition, or reveal one, as insulin does?"}
  F -->|Yes| G["Health data. The purpose will need an Article 9 condition"]
  F -->|No| H["Ordinary personal data"]
  G --> I{"Is the proposed use one the person would expect?"}
  H --> I
  I -->|No| J["Refuse that use, even though the item is already classified"]
  I -->|Yes| K["Record the class and go on to purpose and minimisation"]

Worked example — a nameless slip, then a stapled line

A receipt shows loyalty number 44021 and no name. Sofia marks it personal data because the dispensing system links 44021 to one customer. She does not mark it health data: the slip lists points, not a medicine. The pharmacist staples on "insulin 10 ml". Only the health answer changes. The number was already personal; the medicine makes the slip health data as well. The staple does not reopen the expectation test already settled for promotion.

Synthetic case. Number 44021 and the stapled millilitre line are invented. Articles 4(1) and 9 are real. This is not legal advice.

Apply

• EX051 — Nameless number. Why is loyalty number 44021 personal data when the slip has no name, and why is it not yet health data? Rubric: 3 = Juniper can link the number to one customer, so it is personal; points do not state or reveal an illness;; 2 = it is personal because of the link;; 1 = vague;; 0 = none.
• EX052 — Stapled line. What changes when "insulin 10 ml" is added, and what does not? Rubric: 3 = the slip becomes health data because the line reveals a condition; it was already personal data; the counter-photo refusal is unchanged;; 2 = it becomes health data;; 1 = vague;; 0 = none.

Exercises

• EX001 — Loyalty number. Is a loyalty number personal data? Rubric: 3 = yes, it can be linked to a person;; 2 = yes;; 1 = no;; 0 = none.
• EX002 — Insulin. What can an insulin prescription reveal? Rubric: 3 = a health condition such as diabetes;; 2 = mentions health;; 1 = vague;; 0 = none.
• EX003 — LGPD term. What does the LGPD call special category data? Rubric: 3 = sensitive personal data;; 2 = partly correct;; 1 = other;; 0 = none.
• EX004 — Purchase history. Why might loyalty purchase history be health data? Rubric: 3 = purchases can reveal illnesses or conditions;; 2 = mentions health;; 1 = vague;; 0 = none.
• EX005 — Count principles. How many principles are in GDPR Article 5? Rubric: 3 = seven;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX006 — Necessity. Which LGPD principle resembles minimisation? Rubric: 3 = necessity;; 2 = partly correct;; 1 = other;; 0 = none.
• EX007 — Minimisation sentence. What did Sofia write for minimisation? Rubric: 3 = the app should collect only what points and vouchers need;; 2 = mentions need;; 1 = vague;; 0 = none.
• EX008 — Counter photo. What did Sofia recommend for shop photos? Rubric: 3 = no customers visible or clear permission;; 2 = mentions permission;; 1 = allow;; 0 = none.
• EX009 — Photo purpose. What purpose did the counter photo serve? Rubric: 3 = promotion;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX010 — Expectation. Did customers expect to appear online? Rubric: 3 = no;; 2 = partly correct;; 1 = yes;; 0 = none.
• EX011 — Living persons. Does the GDPR definition cover deceased people? Rubric: 3 = no, living persons;; 2 = partly correct;; 1 = yes;; 0 = none.
• EX012 — Extra condition. What does processing health data need beyond a lawful basis? Rubric: 3 = a specific Article 9 condition;; 2 = mentions condition;; 1 = vague;; 0 = none.
• EX013 — Checklist use. How will Sofia use her principle sentences? Rubric: 3 = as a checklist for later decisions;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 01 (chapter 01 of 20)

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.