(EN)

Documents

Article 29 Working Party, Opinion Nº 4/2007 on the concept of personal data (2007).

Article 29 Working Party, Opinion 1/2008 on data protection issues related to search engines (2008).

Data outlining the use of the service can be divided into different categories:

• the query logs (content of the search queries, the date and time, source (IP address and cookie), the preferences of the user, and data relating to the user’s computer);
• data on the content offered (links and advertisements as a result of each query);
• and data on the subsequent user navigation (clicks).

Search engines may also process operational data relating to user data, data on registered users and data from other services and sources such as e-mail, desktop search, and advertising on third party websites.

An individual’s search history is personal data if the individual to which it relates, is identifiable

Though IP addresses in most cases are not directly identifiable by search engines, identification can be achieved by a third party. Internet access providers hold IP address data. Law enforcement and national security authorities can gain access to these data and in some Member States private parties have gained access also through civil litigation. Thus, in most cases – including cases with dynamic IP address allocation – the necessary data will be available to identify the user(s) of the IP address.

When a cookie contains a unique user ID, this ID is clearly personal data.

ANNEX 1 contains example of data processed by search engines.

Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques (2014).

Data Protection Commission (Ireland), Guidance Note: Anonymisation and Pseudonymisation (2019).

EDPB, Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (2020):

9. There are two principal sources of location data available for modelling the spread of the virus and the overall effectiveness of confinement measures:
– location data collected by electronic communication service providers(such as mobile telecommunication operators) in the course of the provision of their service; and
– location data collected by information society service providers’ applications whose functionality requires the use of such data (e.g., navigation, transportation services,etc.).

EDPB, Guidelines 8/2020 on the targeting of social media users (2020):

18. The term “user” is typically used to refer to individuals who are registered with the service, i.e. those who have an “account” or “profile”. Many social media services can, however, also be accessed by individuals without having registered (i.e. without creating an account or profile). Such individuals are typically not able to make use of all of the same features or services offered to individuals who have registered with the social media provider. Both users and non-registered individuals may be considered “data subjects” within the meaning of Article 4(1) GDPR insofar as the individual is directly or indirectly identified or identifiable.

Case Law

CJEU, Scarlet Extended SA/Société belge des auteurs, compositeurs et éditeurs, C-70/10 (2011).

CJEU, Worten – Equipamentos para o Lar SA/Autoridade para as condições de trabalho, C-342-12 (2013).

CJEU, YS/Minister voor Immigratie, Integratie en Asiel, C-141/12 and C-372/12 (2014).

CJEU, Digital Rights Ireland Ltd/Minister for Communications, Marine and Natural Resources, C-293/12 and C-594/12 (2014).

CJEU, Breyer/Germany, C-582/14 (2016).

CJEU, Nowak/Data Protection Commissioner, C-434/16 (2017).

CJEU, Camera di Commercio, Industria, Artigianato e Agricoltura di Lecce/Manni, C-398/15 (2019).

(EN)

Documents

Article 29 Working Party, Opinion 2/2010 on behavioural advertising (2010):

The behavioural advertising methods often entail the processing of personal data. This is due to various reasons:

i) behavioural advertising normally involves the collection of IP addresses and the processing of unique identifiers (through the cookie). The use of such devices with a unique identifier allows the tracking of users of a specific computer even when dynamic IP addresses are used. In other words, such devices enable data subjects to be ‘singled out’, even if their real names are not known.

ii) Furthermore, the information collected in the context of behavioural advertising relates to, (i.e. is about) a person’s characteristics or behaviour and it is used to influence that particular person. This view is further confirmed if one takes into account the possibility for profiles to be linked at any moment with directly identifiable information provided by the data subject, such as registration related information.

DPC (Ireland), Guidance for Organisations Accidentally in Receipt of Personal Data (2020):

An organisation, whether in the public, private or voluntary sector, must be aware of the possibility of finding itself accidentally in possession of personal data. The broad definition of ‘processing’ in Article 4(2) of the GDPR means that opening, transmitting, deleting or simply storing personal data that you have unintentionally acquired will bring the GDPR into play.

DPC (Ireland), Guidance for Individuals who Accidentally Receive Personal data (2020).

Case Law

CJEC, Tietosuojavaltuutettu/Satakunnan Markkinapörssi Oy and Satamedia Oy, C-73/07 (2008).

CJEC, Lindqvist, C-101/01 (2003).

CJEU, Schwarz/Stadt Bochum, C-291/12 (2013).

CJEU, La Quadrature du Net et al./Premier ministre et al., C-511/18, C-512/18, C-520/18 (2020).

CJEU, Privacy International/Secretary of State for Foreign and Commonwealth Affairs, C-623/17 (2020).

(EN) Article 29 Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (2018):

Profiling is composed of three elements:

• it has to be an automated form of processing;
• it has to be carried out on personal data; and
• the objective of the profiling must be to evaluate personal aspects about a natural person.

Article 4(4) refers to ‘any form of automated processing’ rather than ‘solely’ automated processing (referred to in Article 22). Profiling has to involve some form of automated processing – although human involvement does not necessarily take the activity out of the definition.

Profiling is a procedure which may involve a series of statistical deductions. It is often used to make predictions about people, using data from various sources to infer something about an individual, based on the qualities of others who appear statistically similar.

The GDPR says that profiling is automated processing of personal data for evaluating personal aspects, in particular to analyse or make predictions about individuals. The use of the word ‘evaluating’ suggests that profiling involves some form of assessment or judgement about a person.

A simple classification of individuals based on known characteristics such as their age, sex, and height does not necessarily lead to profiling. This will depend on the purpose of the classification. For instance, a business may wish to classify its customers according to their age or gender for statistical purposes and to acquire an aggregated overview of its clients without making any predictions or drawing any conclusion about an individual. In this case, the purpose is not assessing individual characteristics and is therefore not profiling.

The GDPR is inspired by but is not identical to the definition of profiling in the Council of Europe Recommendation CM/Rec (2010)132 (the Recommendation), as the Recommendation excludes processing that does not include inference. Nevertheless the Recommendation usefully explains that profiling may involve three distinct stages:

• data collection;
• automated analysis to identify correlations;
• applying the correlation to an individual to identify characteristics of present or future behaviour.

Controllers carrying out profiling will need to ensure they meet the GDPR requirements in respect of all of the above stages.

Broadly speaking, profiling means gathering information about an individual (or group of individuals) and evaluating their characteristics or behaviour patterns in order to place them into a certain category or group, in particular to analyse and/or make predictions about, for example, their:

• ability to perform a task;
• interests; or
• likely behaviour.

(EN) EDPB, Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (2020).

(EN)

Case Law

CJEU, Tietosuojavaltuutettu/Jehovan todistajat – uskonnollinen yhdyskunta, C-25/17 (2018).

(EN)

Document

Article 29 Working Party, Opinion 1/2008 on data protection issues related to search engines (2008).

A search engine provider that processes user data including IP addresses and/or persistent cookies containing a unique identifier falls within the material scope of the definition of the controller, since he effectively determines the purposes and means of the processing.

Article 29 Working Party, Opinion 2/2010 on behavioural advertising (2010):

When behavioural advertising entails the processing of personal data, ad network providers also play the role of data controller. Ad network providers have complete control over the purposes and means of the processing.

However, the publishers’ responsibility covers the first stage, i.e. the initial part of the data processing, namely the transfer of the IP address that takes place when individuals visit their websites. This is because the publishers facilitate such transfer and co-determine the purposes for which it is carried out, i.e. to serve visitors with tailored adverting. In sum, for these reasons, publishers will have some responsibility as data controllers for these actions.

Article 29 Working Party, Opinion 1/2010 on the concepts of “controller” and “processor” (2010).

ICO, Guidelines Data controllers and data processors (2014) – Guidelines by the British Supervisory Authority ICO.

CNIL, Guide for processors (2017) – Guidelines by the French Supervisory Authority CNIL.

European Data Protection Supervisor, Concepts of controller, processor and joint controllership under Regulation (EU) 2018/1725 (2019).

EDPB, Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (2020).

EDPB, Guidelines 7/2020 on the Concepts of Controller and Processor in the GDPR (2021).

EDPB, Guidelines 8/2020 on the targeting of social media users (2020).

Data Protection Commission (Ireland), Data Protection Considerations Relating to Receivership (2020):

The ‘controller’ of personal data is the entity that determines the ‘purposes and means’ of processing personal data – i.e. ‘why’ and ‘how’ the personal data is processed.

Case Law

CJEU, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein/Wirtschaftsakademie Schleswig-Holstein GmbH, C-210/16 (2018).

CJEU, Fashion ID GmbH & Co. KG/Verbraucherzentrale NRW eV, C-40/17 (2019).

(EN) Article 29 Working Party, Opinion 1/2010 on the concepts of “controller” and “processor” (2010).

CNIL, Guide for processors (2017) – Guidelines from the French Supervisory Authority CNIL.

European Data Protection Supervisor, Concepts of controller, processor and joint controllership under Regulation (EU) 2018/1725 (2019).

(EN)

Document

EDPB, Guidelines 5/2020 on Consent under Regulation 2016/679 (2020).

Case law

CJEU, Schwarz/Stadt Bochum, C-291/12 (2013).

CJEU, Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband eV/Planet49 GmbH, C‑673/17 (2019).

(EN) Article 29 Working Party, Guidelines on Personal Data Breach Notification Under Regulation 2016/679 (2018):

In its Opinion 03/2014 on breach notification, WP29 explained that breaches can be categorised according to the following three well-known information security principles:
– “Confidentiality breach” – where there is an unauthorised or accidental disclosure of, or access to, personal data.
– “Integrity breach” – where there is an unauthorised or accidental alteration of personal data.
– “Availability breach” – where there is an accidental or unauthorised loss of access to, or destruction of, personal data.

(EN) Article 29 Working Party, Working Document on Genetic Data (2004).

(EN)

To qualify as biometric data as defined in the GDPR, processing of raw data, such as the physical, physiological or behavioural characteristics of a natural person, must imply a measurement of this characteristics. Since biometric data is the result of such measurements, the GDPR states in its Article 4.14 that it is “resulting from specific technical processing relating to the physical, physiological or behavioural characteristics”.The video footage of an individual cannot however in itself be considered as biometric data under Article 9, if it has not been specifically technically processed in order to contribute to the identification of an individual.

In order for it to be considered as processing of special categories of personal data (Article 9) it requires that biometric data is processed “for the purpose of uniquely identifying a natural person”.
To sum up, in light of Article 4.14 and 9, three criteria must be considered:

— Nature of data: data relating to physical, physiological or behavioural characteristics of a natural person,

— Means and way of processing: data “resulting from a specific technical processing”,

— Purpose of processing: data must be used for the purpose to uniquely identifying a natural person.

EDPB, Guidelines 3/2019 on processing of personal data through video devices — 2019

Article 29 Working Party, Opinion 03/2012 on developments in biometric technologies  (2012).

Article 29 Working Party, Opinion 02/2012 on facial recognition in online and mobile services  (2012).

Article 29 Working Party, Working document on biometrics (2003).

(EN)

Documents

EDPB, Guidelines 3/2020 on the Processing of Data Concerning Health for the Purpose of Scientific Research in the Context of the Covid-19 Outbreak, (2020).

(EN)

Documents

EDPB, Guidelines on relevant and reasoned objection under Regulation 2016/679 (2020).