Big Data and ‘Personal Information’ in Australia, the European Union and the United States

Abstract

INTRODUCTION Information that can be associated with an identifiable individual is given special treatment in law in many countries This ‘personal information’, as it is called in Australia, attracts the coverage of privacy and data protection law The scope of the information that fits within the relevant definition varies between jurisdictions, and is a core concern of this chapter. Information, which cannot be associated with an identifiable individual in the way defined in a particular jurisdiction, escapes such classification as ‘personal’ It can then be dealt with under oft en less restrictive controls outside of privacy and data protection law such as contractual restrictions on data scraping imposed by data owners, or issues involving copyright clearance This has significant implications for both data subjects (whose information is less protected) and data custodians (who face fewer regulatory constraints) Privacy and data protection laws typically only apply when data or information is linked to a person, or is capable of the identification of a person If Big Data items or records do not fall within the relevant legal definition of categories such as ‘personal information’, ‘personal data’ or their equivalent, they are not subject to privacy law in a given jurisdiction, so there are fewer rules for their use and transfer Where information is ‘personal’ there are a variety of methods that are used, in particular in data analytics, to make the information non-identified The terms for these methods include ‘anonymous’, ‘pseudonymous’, ‘de-identified’, ‘depersonalised’, ‘data minimisation’ and ‘not personal data’ . Although the technology practices known as ‘Big Data’ raise many important privacy issues, this paper focuses on their effect on questions about whether a particular record or data set is considered ‘personal’ and therefore ‘about’ an identifiable individual We survey definitions of personal data or information (or their equivalent) in jurisdictions including Australia, the United States and the European Union in the context of identifiability and Big Data. The divergence of the definitions used in the jurisdictions helps explain some of the differences in how they respond to Big Data developments – and to the challenges that Big Data tools may pose for legal systems.