welcome to module three personal data at the end of this module you will have a basic understanding of what constitutes personal data the different categories of personal data if your doctor shares your medical history with researchers conducting a medical trial but replaces your name with a code which they do not disclose so the record appears to be anonymous is this still your personal data the answer will be given at the end of this module personal data definition any information relating to an identified or identifiable natural person the key phrases an identified or identifiable either a named person or a person who can be identified using a combination of all the data available example if a newspaper writes a story about suspected financial irregularities at a hospital and mentions that their source was an anonymous junior doctor from the New Castle who had previously worked at two named hospitals it would be possible with a small amount of research to determine the junior doctor's name the key is that the person can be identified data types data falls into four main categories three of these are covered by the GD P R let's discover all these different data types anonymous data all identifiable elements removed to the extent that an individual's identity cannot be determined for example a company wants to use its payroll file to conduct a statistical analysis of the gender pay gap if all columns accept gender and pay are removed the data is anonymous note if roles are included in the anonymized payroll file it might be possible to identify an individual as they may be the only person completing that role within the company in this case the data would not be considered anonymous under the GDP our anonymous data is not covered by the GDP our pseudonymous data information that no longer allows the identification of an individual without additional information for example a payroll file may have employees names addresses and company roles removed for analysis but keep their employee ID this is pseudonymous since it's not possible to immediately identify an individual however it is possible to use other sources to match IDs to names which does make the data identifiable pseudonymous data is covered by the GDP our personal data information that relates to an identifiable person for example name address bank details gender occupation place of work telephone number note that some details for example gender a personal data only when combined with other information by itself it is just a label personal data is covered by the GDP our sensitive data the gdpr identifies special categories of data which merit higher protection these include race ethnicity religious political and philosophical beliefs trade union membership genetic and biometric data health data sex life sexual orientation criminal offenses the processing of special category data is prohibited unless certain criteria are met for example if an individual has given explicit consent sensitive data is covered by the gdpr note the gdpr applies to all residents of the European Economic Area regardless of their nationality meaning it applies equally to a US citizen living in the UK and a German living in Germany the gdpr does not apply to deceased individuals companies or organizations back to the question of whether the data provided to the medical researchers is personal as we have seen if there is the possibility of the day - identifying you then it is still personal data in this case the code which replaces your name could be deciphered by the original doctor so both the doctor and researchers need to treat the data according to the principles of the gdpr this data has been sudana mised but not anonymized we will now ask you two short questions some time will be left for you to think about the answer however feel free to pause the video after the question is asked to allow yourself enough time to think about the answer you do not need to click on the boxes or dots to provide your answers the answers will be given shortly after the questions have been asked if my company holds my name address bank details next-of-kin and health information is all this information considered to be of equal importance from a data protection perspective yes or no No some data is classed as personal whereas some is classed as special which limits the ways an organization can use it match the correct data and data type the answer will be given shortly you bank details a personal data political views a sensitive data and the salary range for an unnamed personal assistant is anonymous this is the end of our module three personal data you can now move on to module four principles [Music]