Additionally, even if the business does not know the name of the individual, using a MAC address (or other unique identifier) to track a device with the purpose of singling out that individual or treating them differently means the data is also personal data. If an individual can be identified from that MAC address, or other information in the possession of the network operator (the business, in this example), then the data is personal data. MAC addresses are intended to be unique to the device (although they can be modified or spoofed using software). This involves the business processing the Media Access Control (MAC) addresses of mobile devices that broadcast probe requests to its public Wi-Fi hotspots. It is not necessary to know whether an individual has visited an individual store (or multiple stores) before. The key point of indirect identifiability is when information is combined with other information that then distinguishes and allows for the identification of an individual.Ī business uses Wi-Fi analytics data to count the number of visitors per hour across different retail outlets.
It’s important to be aware that information you hold may indirectly identify an individual and therefore can still be personal data. What factors should we consider when assessing the possibility of identification?.If there is only a very slight possibility that an individual could be indirectly identified, is it still personal data?.Can we or someone else identify an individual from information we hold and they hold?.Can we identify someone from other information we hold?.What kind of information could allow an individual to be indirectly identified?.