Picture what a shop knows about you after one order. Your name, your address, your card, which day you are home. Each one is a fact. Together they are you. The law calls any fact that points to a living person personal data, and since 2018 a European law, with a UK copy, says what may be done with it.
Collect only what you need→Say what for→Keep it safe→Tell the watcher in 72 hours
The law has a few rules. Collect only what you need, and keep it no longer than you need it. Say what you will use it for. Keep it safe. Let the person see it and have it corrected. When it leaks, tell the watcher within 72 hours of finding out, if people could be harmed by it.
Each card is a fact a company holds. Does it point to a person, or not?
One card at a time. Tap the pile it belongs to.
Card 1 of 6
An email address, kim.p@example.com
The number of orders the shop took on Tuesday
A car's number plate caught on camera
The temperature in the warehouse
A customer number with no name, but the shop can look the name up
The price of a loaf
An email address, kim.p@example.com → Personal data
Not yet. Personal. It reaches one person, and it is probably their name too.
The number of orders the shop took on Tuesday → Not personal
Not yet. Not personal. A count of orders points at the shop's day, not at anybody who placed one.
A car's number plate caught on camera → Personal data
Not yet. Personal. A plate can be looked up to the keeper, so it points to a person even without a name on it.
The temperature in the warehouse → Not personal
Not yet. Not personal. Nothing about a thermometer reading relates to a human being.
A customer number with no name, but the shop can look the name up → Personal data
Not yet. Personal. The law says identifiable, not identified. If the shop can get from the number to the person, it is personal data.
The price of a loaf → Not personal
Not yet. Not personal. A price is about the loaf. It would become personal only once it was tied to who bought it.
3Personal data
vsvs
3Not personal
Right. Three and three. The test is not whether a name is written on it. It is whether the fact can be got back to one living person.
Friday, 5pmleak found
↓→
72 hours
↓→
Monday, 5pmreport due
A leak is called a breach, and the clock is the part companies get wrong. Seventy-two hours runs from when the company became aware, not from when it finished investigating. And the clock does not wait for the weekend. A company that finds a leak at five on Friday owes the watcher a report by five on Monday.
Tuesday, 9am→72 hours→Friday, 9am: due→Friday, 2pm: sent
A leak was found at 9 in the morning on a Tuesday. The report went in at 2 in the afternoon on Friday. By how many hours was it late?
hours
Count three days forward from Tuesday 9am, then see how far past that 2pm is.
Right. Five hours. Seventy-two hours from Tuesday at nine is Friday at nine. Two in the afternoon is five hours past it. Late is late. 'We were still investigating' does not help, because the clock runs from finding out, not from finishing.
Picture a shop that holds 50,000 customers. Move how much of each record it keeps and see how many facts leak if it is hacked. Made up to show the shape.
2 of 20
facts held on each customer
What the shop keeps on each customer: Name and email only
Name and email only: 2 facts each. If the shop is hacked, 100,000 facts leak.
4 of 20
facts held on each customer
What the shop keeps on each customer: Address and phone as well
Address and phone as well: 4 facts each. If the shop is hacked, 200,000 facts leak.
6 of 20
facts held on each customer
What the shop keeps on each customer: Date of birth and card as well
Date of birth and card as well: 6 facts each. If the shop is hacked, 300,000 facts leak.
20 of 20
facts held on each customer
What the shop keeps on each customer: Every order for five years as well
Every order for five years as well: 20 facts each. If the shop is hacked, 1,000,000 facts leak.
What does 'collect only what you need' do to a leak?
It makes the leak smaller before it happens. A fact not held cannot leak.
Right. The hack is the same in every frame. What leaks is ten times bigger in the last one, and the whole difference is what was kept.
Nothing. A hack is a hack.
Not yet. The hack is the same in every frame, and the leak is 100,000 facts in one and a million in another. The difference is what the shop chose to keep.
It stops the hack.
Not yet. This rule is about what is in the cupboard, not the lock. The lock is 'keep it safe', which is a different rule, and this one works even when the lock fails.
Move the control.
over a million under-13sTikTok
++
£12.7 millionThe fine, 2023
In 2023 the UK watcher fined TikTok £12.7 million. The app had let more than a million UK children under 13 use it in 2020 without a parent's consent, and had used their data. The money was not the point. The finding was: a company must know whose data it holds, and a child's has extra rules.
Three things a shop does with your email. Tap the one the law allows without asking you anything more.
Tap the part of the picture that answers it.
Sends your receipt
++
Sells it to another shop
++
Keeps it ten years, in case
Sends your receipt
Right. You ordered; the receipt is part of the order. Using your email for the thing you gave it for is what 'say what for' allows.
Sells it to another shop
Not yet. You gave the email for your order, not for a sale. Passing it to a stranger is a new use, and a new use needs its own permission.
Keeps it ten years, in case
Not yet. 'In case' is not a need. The law says keep a fact only as long as you need it for the reason you took it, and an old receipt does not need ten years.
A ticketneeds a name and a way to pay
vsvs
The app asks forlocation, contacts, birthday
A football club's ticket app asks for your name, your date of birth, your location at all times, and your contacts list. From this lesson, which rule is it breaking?
None. You ticked the box.
Not yet. Ticking a box does not make a contacts list necessary for a ticket. The law asks whether the fact is needed, and a box cannot make it needed.
Collect only what you need. A ticket needs a name and a way to pay, not your contacts.
Right. The rule is about what is asked for, before any lock matters. Your contacts list is other people's personal data, and a ticket does not need it.
Keep it safe. An app cannot be safe.
Not yet. Safety is about the lock. This is about what the app asked for before any lock mattered, and the explore step showed why that comes first.
Lesson complete
Personal data is anything that points to a living person, and the law says what may be done with it.