Personal data

Personal data is any information related to an identifiable person. A person may be identified by a personal identity number, name, images, e-mail address, IP-address or a number referring to a list of names, or through a combination of different background information.

A person will be directly identifiable by name, personal identity number or other uniquely personal characteristics.

A person will be indirectly identifiable by combined background information such as place of residence, institutional affiliation, age, gender, occupation, income, diagnosis, etc.

Sensitive personal data is information related to racial or ethnic origin, political, philosophical or religious beliefs, criminal offences (that a person has been suspected, charged or convicted of a crime), information on health, sex life and union membership.

De-identified personal data is information from which name, personal identity number and other characteristics identifying a person have been removed and replaced by number, a code, fictitious name or similar, referring to a separate list of identifiable data. To be de-identified indirect identifiable personal data must be categorized into broad categories or removed. Broad categories might be e.g. regions instead of specified municipalities, age in intervals rather than precise age. The only way to identify individuals in a de-identified data set will be through the list of names/code keys. De-identified data is considered personal data regardless of who holds the list of names, where and how it is stored.

Anonymous data cannot identify individuals in the data set, neither directly or indirectly, nor through encryption or code.

To anonymize a data set one needs to delete links to list of names and addresses, and categorize or delete indirectly identifiable personal information. Data is considered anonymous only when the entire data set has been anonymized (including the raw data).