In early March, cybersecurity professionals around the world filled the San Francisco Moscone Convention Center’s sprawling exhibition halls to discuss and learn about everything infosec, from public key encryption to incident response, and from machine learning to domestic abuse.
It was RSA Conference 2019, and Malwarebytes showed up to attend and present. Our Wednesday afternoon session—“One person can change the world—the story behind GDPR”—explored the European Union’s new, sweeping data privacy law which, above all, protects “personal data,” which sounds an awful lot like “personally identifiable information.”
But the law’s broad language—and finite, severe penalties—left audience members with a lingering question: What exactly is personal data?
The answer: It depends.
Personal data, as defined by the EU’s General Data Protection Regulation, is not the same as “personally identifiable information,” as defined by US data protection and cybersecurity laws, or even “personal information” as defined by California’s recently-signed data privacy law. Further, in the US, data protection laws and cybersecurity laws serve separate purposes and, likewise, bestow slightly separate definitions to personal data.
Complicating the matter is the public’s instinctual approach to personal information, personal data, and online privacy. For everyday individuals, personal information can mean anything from telephone numbers to passport information to postal codes—legal definitions be damned.
Today, in the latest blog for our cybersecurity and data privacy series, we discuss the myriad conditions and legal regimes that combine to form a broad understanding of personal information.
Companies should not overthink this. Instead, data privacy lawyers said businesses should pay attention to what information they collect and where they operate to best understand personal data protection and compliance.
As Duane Morris LLP intellectual property and cyber law partner Michelle Donovan said:
“What it comes down to, is, it doesn’t matter what the rules are in China if you’re not doing business in China. Companies need to figure out what jurisdictions apply, what information are they collecting, where do their data subjects reside, and based on that, figure out what law applies.”
What law applies?
The personal information that companies need to protect changes from law to law. However, even though global data protection laws define personal information in diverse ways, the definitions themselves are not important to every business.
For instance, a small company in California that has no physical presence in the European Union and makes no concerted efforts to market to EU residents does not have to worry about GDPR. Similarly, a Japanese startup that does not collect any Californians’ data does not need to worry about that state’s recently-signed data privacy law. And any company outside the US that does not collect any US personal data should not have to endure the headaches of complying with 50 individual state data breach notification laws.
Baker & McKenzie LLP of counsel Vincent Schroeder, who advises companies on privacy, data protection, information technology, and e-commerce law, said that the various rules that determine which laws apply to which businesses can be broken down into three basic categories: territorial rules, personal rules, and substantive rules.
Territorial rules are simple—they determine legal compliance based on a company’s presence in a country, state, or region. For instance, GDPR applies to companies that physically operate in any of the EU’s 28 member-states, along with companies that directly market and offer their products to EU citizens. That second rule of direct marketing is similar to another data privacy law in Japan, which applies to any company that specifically offers its products to Japanese residents.
“That’s the ‘marketplace rule,’ they call it,” Schroeder said. “If you’re doing business in that market, consciously, then you’re affecting the rights of the individuals there, so you need to adhere to the local regulatory law.”
Substantive rules, on the other hand, determine compliance based on a company’s characteristics. For example, the newly-passed California Consumer Privacy Act applies to companies that meet any single one of the following three criteria: pull in annual revenue of $25 million, derive 50 percent or more of that annual revenue from selling consumers’ personal information, or buy, receive, sell, or share the personal information of 50,000 or more consumers, households, or devices.
Businesses that want to know what personal information to legally protect should look first to which laws apply. Only then should they move forward, because “personal information” is never just one thing, Schroeder said.
“It’s an interplay of different definitions of the territorial, personal, and substantive scopes of application, and for definitions of personal data,” Schroeder said.
Personal information—what’s included?
The meaning of personal information changes depending on who you ask and which law you read. Below, we focus on five important interpretations. What does personal information mean to the public? What does it mean according to GDPR? And what does it mean according to three state laws in California—the country’s legislative vanguard in protecting its residents’ online privacy and personal data.
The public
Let’s be clear: Any business concerned with legal obligations to protect personal information should not start a compliance journey by, say, running an employee survey on Slack and getting personal opinions.
That said, public opinions on personal data are important, as they can influence lawmakers into drafting new legislation to better protect online privacy.
Jovi Umawing, senior content writer for Malwarebytes Labs who recently compiled nearly 4,000 respondents’ opinions on online privacy, said that personal information is anything that can define one person from another.
“Personal information for me is relevant data about a person that makes them unique or stand out,” Umawing wrote. “It’s something intangible that one owns or possesses that (when combined with other information) points back to the person with very high or unquestionable accuracy.”
Pieter Arntz, malware intelligence researcher for Malwarebytes, provided a similar view. He said he considers “everything that can be used to identify me or find more specific information about me as personal information.” That includes addresses, phone numbers, Social Security numbers, driver’s license info, passport info, and, “also things like the postal code,” which, for people who live in very small cities, can be revealing, Arntz said.
Interestingly, some of these definitions overlap with some of the most popular data privacy laws today.
GDPR
In 2018, the General Data Protection Regulation took effect, granting EU citizens new rights to access, transport, and delete personal data. In 2019, companies are still figuring out what that personal data encompasses.
The text of the law offers little clarity, instead providing this ocean-wide ideology: “Personal data should be as broadly interpreted as possible.”
According to GDPR, the personal data that companies must protect includes any information that can “directly or indirectly” identify a person—or subject—to whom the data belongs or describes. Included are names, identification numbers, location data, online identifiers like screen names or account names, and even characteristics that describe the “physical, physiological, genetic, mental, commercial, cultural, or social identity of a person.”
That last piece could include things like an employee’s performance record, a patient’s medical diagnosis history, a user’s specific anarcho-libertarian political views, and even a person’s hair color and length, if it is enough to determine that person’s identity.
Donovan, the attorney from Duane Morris, said that GDPR’s definition could include just about any piece of information about a person that is not anonymized.
“Even if that information is not identifying [a person] by name, if it identifies by a number, and that number is known to be used to identify that person—either alone or in combination—it could still associate with that person,” Donovan said. “You should assume that if you have any data about an individual that is not anonymized when you get it, it’s likely going to be covered.”
The California Consumer Privacy Act
In June 2018, California became the first state in the nation to respond to frequent online privacy crises by passing a comprehensive, statewide data privacy law. The California Consumer Privacy Act, or CCPA, places new rules on companies that collect California residents’ personal data.
The law, which will go into effect in 2020, calls this type of data “personal information.”
“Personal information,” according to the CCPA, is “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
What that includes in practice, however, is a broad array of data points, including a person’s real name, postal address, and online IP address, along with biometric information—like DNA and fingerprint data—and even their browsing history, education history, and what the law vaguely describes as “audio, electronic, visual, thermal, olfactory, or similar information.”
Aside from protecting several new data types, the CCPA also makes a major change to how Californians can assert their data privacy rights in court. For the first time ever, a statewide data privacy law details “statutory damages,” which are legislatively-set, monetary amounts that an individual can ask to recover when filing a private lawsuit against a company for allegedly violating the law. Under the CCPA, people who believe their data privacy rights were violated can sue a company and ask for up to $750.
This is a huge shift in data privacy law, Donovan said.
“For the first time, there’s a real privacy law with teeth,” Donovan said.
Previously, if individuals wanted to sue a company for a data breach, they needed to prove some type of economic loss when asking for monetary damages. If, say, a fraudulent credit card was created with stolen data, and then fraudulent charges were made on that card, monetary damages might be easy to figure out. But it’s rarely that simple.
“Now, regardless of the monetary damage, you can get this statutory damage of $750 per incident,” Donovan said.
California’s data breach notification law and data protection law
If we stay in California but go back in time several years, we see the start of a trend—California has been the first state, more than once, to pass data protection legislation.
In 2002, California passed its data breach notification law. The first of its kind in the United States, the law forced companies to notify California residents about unauthorized access to their “personal information.”
The previous definitions of personal information and data that we’ve covered—GDPR’s broad, anything-goes approach, and CCPA’s inclusion of heretofore unimagined “olfactory,” smell-based personal data—do not apply here.
Instead, personal information in the 17-year-old law—which received an update five years ago—is defined as a combination of types of information. The necessary components include a Californian’s first and last name, or first initial and last name, paired up with things like their Social Security number, driver’s license number, and credit card number and corresponding security code, along with an individual’s email address and password.
So, if a company suffers a data breach of a California resident’s first and last name plus their Social Security number? That’s considered personal information. If a data breach compromises another California resident’s first initial, last name, and past medical insurance claims? Once again, that data is considered personal information, according to the law.
In 2014, this definition carried somewhat over into California’s data protection law. That year, then-California governor Jerry Brown signed changes to the state’s civil code that created data protection requirements for any company that owns, licenses, or maintains the “personal information” of California residents.
According to Assembly Bill No. 1710, “personal information” is, once again, the combination of information that includes a first name and last name (or first initial and last name), plus a Social Security number, driver’s license number, credit card number and corresponding security number, and medical information and health information.
The definitions are not identical, though. California’s data protection law, unlike its data breach notification law, does not cover data collected by automated license plate readers, or ALPRs. ALPRs can indiscriminately—and sometimes disproportionately—capture the license plate numbers of any vehicles that cross into their field of vision.
Roughly one year later, California passed a law to strengthen protections of ALPR-collected data.
Personal information—the takeaway
By now, it’s probably easier to define what personal information isn’t rather than what it is (obviously, there is a legal answer to that, too, but we’ll spare the details). These evolving definitions point to a changing legal landscape, where data is not protected solely because of its type, but because of its inherent importance to people’s privacy.
Just as there is no one-size-fits-all definition to personal information, there is no one-size-fits-all to personal data protection compliance. If a company finds itself wondering what personal data it should protect, may we suggest something we have done for every blog in this series: Ask a lawyer.
Join us again soon for the next blog in our series, in which we will discuss consumer protections for data breaches and online privacy invasions.