19

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process.

I work in eCommerce in UX (UK based) and support marketing teams with certain activities.

My question is, does gender of an individual count as PII?

We store gender in a data layer as a JavaScript variable which is held within our own business, we then can choose to pass these variables across to a testing platform to target individuals based on the presence of these variables. As I'm not a legal/data type person I'm not 100% sure if by us storing and having the means to pass a person's gender (pulled from info we get when they create an account with us) to a third party, we are breaching any kind of information security agreements?

If this is down to company policy etc. then just let me know and I'll close the question as it's not really for here.

sclarke
  • 301
  • 1
  • 2
  • 9
  • 9
    Please refer to this - https://dbsdata.co.uk/wp-content/uploads/2018/03/DBS-Data-Guide-to-The-GDPR-Final.pdf can I just mention that DO NOT AT ALL take anyones comments/answers here as legal advice. If you're still unsure please seek professional legal advice. On page 10 of my link you will find a list of all data considered as "PII" –  May 17 '18 at 11:38
  • @JoshJones Of course, I just wanted to gauge whether I should go further into investing this. Thanks for the help. – sclarke May 17 '18 at 12:16
  • if you just store aggregation of a gender that cannot identify a individual, you are somewhat safe. If you store tons of data that able to inter-connect with the gender, the answer is no, you need a opt-in consent from the person. Yet another example, if one develop a "toilet use counter" to research whether toilet should be expanded, make use of motion sensor to count is fine. HOWEVER, if the building only has one female, this will be clear invasion of privacy. So common sense also come into play. – mootmoot May 17 '18 at 12:29
  • How many options do you have for gender? There may for example be rare gender chromosome configurations like XXXXY that come close to identifying individuals. – Mike Scott May 17 '18 at 13:01
  • @MikeScott We're not that advanced... I did suggest last year that we are more inclusive of peoples genders if they wish to identify as xyz but we still only have the male/female variables. – sclarke May 17 '18 at 14:03
  • 2
    @Cronax We don't assign users a gender automatically - they choose themselves at the time of account creation. It's a totally free choice. It's actually used so we don't send adverts for dress and women's underwear to our male customers. This discuss could go on forever so lets leave it alone for the sake of the thread! – sclarke May 17 '18 at 15:09

2 Answers2

22

The definition of personal data as mentioned in the GDPR:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

As you state that you use the presence of the variable to target individuals, the gender definitely has an indirect reference to someone's identity and as such, is personal data. However, that doesn't mean that you have to stop processing the gender in the context you described.

From a risk perspective (which is what the GDPR is all about), I don't see an issue if you only share the gender - which is actually pseudonymised since you don't supply any other direct identification data along with it.

However, you do have other obligations w.r.t. the transparency principle, incorporating the processing activity into your processing register, determining legal ground for processing (and acting accordingly), determining processor-controller relationship with your third party and including the necessary clauses in the the contract, etc. To determine all this, much more information is required than you have supplied in your question and I highly encourage to seek (legal) professional advice to support you in this matter.

Stef Heylen
  • 1,726
  • 1
  • 14
  • 16
8

TLDR: Possible

From https://www.seobyrvc.com/what-is-personally-identifiable-information-pii/:

The following are examples of “potentially personally-identifiable information”. That is, the data elements by themselves cannot be linked to a specific person but when combined with other information (such as items 1 through 11, above), they can be.

  1. A persistent identifier such as a generic customer/user value held in a “cookie”
  2. IP (Internet Protocol) address or host name
  3. Date of birth, age
  4. Racial or ethnic background
  5. Religious affiliation
  6. Gender
  7. Height, weight
  8. Marital status
  9. Employment information
  10. Medical information
  11. Financial information
  12. Credit information
  13. Student information

Depending on a site visitor’s browser settings, cookies (item 12), which are small text files, are stored on the visitor’s local drive and transmitted between their browser and the servers hosting the sites visited.

The point here is, as standalone information, these data elements are not PII. They have the potential to be PII. They become PII when they are combined with other more specific data which, in total, identifies a specific person.

For example, a full blown credit report without a link to a specific individual is not PII. It’s simply anonymous credit information. However, even though a credit report might not have a person’s first and last name, if it includes enough information to identify to a particular person (i.e. date of birth + gender + ethnicity + zip code + IP address), it fits the definition of PII.

ruakh
  • 109
  • 2
  • 7
toom
  • 584
  • 3
  • 20
  • 4
    This answer's source is not at ALL within the context of the specific legal wording of the GDPR, I would not recommend using it as a guideline for GDPR specific concerns. At issue is specific legal wording and context, not just general loose concepts. – taswyn May 17 '18 at 20:51
  • 1
    @taswyn I agree, I had commented underneath the other comment that i prefered that answer. However it got deleted (Rightfully so, It didnt add anything indeed) . – toom May 17 '18 at 20:57