Personal data classification depends on recipient's ability to identify an individual

The Upper Tribunal has delivered a significant ruling, stating that the classification of personal data depends on the recipient's ability to identify an individual from the information. The decision in DSG Retail Limited v The Information Commissioner held that the risk is judged from the perspective of the data that a third party can access, rather than the entire data set held by the data controller.

This judgment, which has the status of binding precedent, clarifies that if a recipient cannot identify an individual from the requested information, the information is not personal data in their hands. This is highly important for Freedom of Information Act (FOIA) requests, as it suggests that disclosure would not breach data protection principles if the applicant cannot identify the subject.

In a LinkedIn post examining the decision, data protection specialist Jon Baines notes that the decision largely mirrors a recent ruling by the European Court of Justice (CJEU). 

Having failed in its appeal to the Upper Tribunal, the Court of Appeal has granted the ICO permission to appeal.