A new approach to categorising personal data to increase transparency under the obligation to inform

Abstract

This thesis contributes to the field of privacy and data protection law, within both Law and Computer Science, by helping to better understand how to increase the transparency of personal data processing and to categorise personal data. To counter the threat to the privacy of individuals which increasing advancements in Information Technology have created, Data Protection laws have been introduced, which include the key principle of transparency. However, as the de facto method of compliance with the obligation to inform (which mandates the provision of certain information about personal data processing to individuals), Privacy Policies have continuously been criticised in their ability to make processing transparent. This problem makes the study of how to increase the transparency of personal data in the context of providing information to individuals about the processing of their personal data a key research area in both Law and Computer Science. In researching this problem, this thesis begins by highlighting a gap in the current literature due to the assumption that the problem lies in how information about processing is presented, summarised or communicated, rather than questioning what information is required for processing to be transparent. The finding that Social Networking Sites provided information about the specific personal data they processed in their Privacy Policies, despite the UK data protection Regulator not making this a recommendation led to the next contribution, a critical analysis of the previous and current data protection law of the EU and the UK on when it is a requirement to inform individuals about the specific personal data being processed. This analysis highlighted that despite its benefits in increasing transparency, organisations are not always required to provide information about the specific personal data they process under the obligation to inform and where they are, the term ‘category’ is used to differentiate between personal data, without a complete categorisation or sufficient guidance on how to do this beyond the categorisation of ‘Special Categories’ of personal data. This gap has led to various parties inferring categorisations from the law, or creating their own, without following a categorisation methodology or taking a consistent approach. The result is inconsistent approaches to categorisation of personal data, which fail to achieve the aims of the principle of transparency. The final contribution of this thesis is a proposed categorisation of personal data, based on categorisation methodology and the Data Information Knowledge Wisdom model in Computer Science, which aims to support organisations in increasing the transparency of their personal data processing and can be built upon in the future to support compliance with the Framework’s wider compliance requirements.

More information

Identifiers

ORCID for David Millard: orcid.org/0000-0002-7512-2710

Catalogue record

Export record