Identifying an individual in PDPA – CPD courses
Example: CPD courses
Personal data under the PDPA may include the following:
- Full name
- NRIC Number or FIN (Foreign Identification Number)
- Passport number
- Photograph or video image of an individual
- Mobile telephone number
- Personal email address
- Thumbprint
- DNA profile
- Name and residential address.
5.11 An individual can also be identified based on certain data and other information to which the organisation has or is likely to have access. Therefore, even if such data is not directly identifying data, it may still be considered personal data if the organisation has access to other information that, when taken together with the data, will allow the individual to be identified. Please also refer to the section on Anonymisation in the Advisory Guidelines on Selected Topics, which describes the conditions under which personal data may be rendered anonymous and hence no longer considered to be personal data for the purposes of the PDPA. CPD courses.
Example:
As part of a research study, a participant is requested to submit information to the research institute, comprising all of the following:
The participant’s name
A general description of the participant, e.g. 30-year-old married Chinese female of AB+ blood type;
Educational institutions that the participant has attended; and
The participant’s occupation
The research institute replaces the participant’s name with a randomly-generated tag in order to safeguard the participant’s anonymity. Without the name, the research institute cannot use the rest of the information to identify a specific individual. However, the research institute continues to hold the key or method that can reverse the randomisation and reinstate the participant’s name. In this case, all the participants’ information held by the research institute would still be personal data held by the research institute. CPD courses.
5.12 Whether a certain piece or set of data is personal data will depend on the context. Data that may identify an individual in a certain situation may not in another. For example, an individual’s residential address is often regarded as forming part of the individual’s personal data. While this is true if the address is collected as part of other data about the individual, for example, with his name and other contact information, the address on its own may not be personal data in other contexts. For example, as noted earlier, the address may be used to identify the particular premises and there may be a number of individuals, or none, living at the address.
Source: PDPC
Click here to go to CPD courses.