<p>The DIFC Data Protection Law 2007 applies in the jurisdiction of the Dubai  International Financial Centre.&nbsp;This legislation governs the processing of  &ldquo;personal data&rdquo;.&nbsp; It protects the rights of &ldquo;data subjects&rdquo;, namely the people  to whom personal data relates.&nbsp; The term &ldquo;personal data&rdquo; is defined in the DIFC  Data Protection Law as &ldquo;any information relating to an identifiable natural  person&rdquo;. An identifiable natural person is &ldquo;a natural person who can be  identified, directly or indirectly in particular by reference to an  identification number or to one or more factors specific to his biological,  physical, biometric, physiological, mental, economic, cultural or social  identity&rdquo;.&nbsp; The key part of the definition of identifiable natural person is the  first ten words, namely &ldquo;a natural person who can be identified, directly or  indirectly&rdquo;, as the subsequent words comprise a list of reference  points.&nbsp;<br /><br />In some cases it is clear that information is &ldquo;personal data&rdquo;  for the purpose of the DIFC Data Protection Law.&nbsp; However, in recent times we  have considered categories of information which may or may not be personal data,  and the answer is not always clear.&nbsp; At the DIFC Data Commissioner&rsquo;s website one  reads the following: &ldquo;Personal data is any information relating to an identified  natural person or identifiable natural person. For example, personal data may  include individual&rsquo;s name, age, home address, race, sexual orientation, income,  blood type, marital status, education, and employment information &hellip; [it] may  include an employer&rsquo;s appraisal or opinion of an employee.&rdquo;&nbsp; The website further  states: &ldquo;Whether information relates to a particular individual will be a  question of fact in each case.&nbsp; If a connection can be made between the  information and an individual, then the information is personal data.&nbsp; Personal  data can relate to more than one individual.&nbsp; For example, information  concerning a joint bank account relates to both account holders and therefore is  the personal data of each account holder and will be protected as such.&rdquo;&nbsp;  <br /><br />This is helpful, but not comprehensive.&nbsp; Thus we have looked to how  other jurisdictions, who have laws similar to the DIFC Data Protection Law, have  addressed the question &ldquo;What is personal data?&rdquo;&nbsp; Our view is that &ldquo;context is  everything&rdquo;, or at least context is most important in assessing whether  information is actually personal data.&nbsp; While it is not possible to address the  many different types of information which an organization operating in the DIFC  may encounter, we thought it would be useful to outline some key issues in this  article.<br /><br />An individual is &ldquo;identified&rdquo; if it is possible to distinguish  that individual from other members of a group.&nbsp; A name is the most common means  of identifying someone.&nbsp; However, if there are two or more people within an  organization of the same name the name of itself may not be personal data.&nbsp; When  the name is combined with some other information about the person such as their  address or telephone number that will usually be sufficient to identify the  individual, and thus the name plus that additional information is together  personal data.&nbsp; Yet it is not necessary to have a person&rsquo;s name to identify the  person if you have other information when, put together, is sufficient to  identify them.&nbsp; For instance, in the employment context, information relating to  the person&rsquo;s position of employment, salary, commencement date and  qualifications may be sufficient, when combined, to constitute personal data.&nbsp; A  judgment call is required when assessing the combination of information.&nbsp; A  practical approach is to ask whether such pieces of information would, in  practice, reasonably be likely to be put together in this way, or whether it is  unrealistic to assume that this would take place.&nbsp; What this means that if an  organization puts in place mechanisms which prevent the combination of  information in this way, it may be possible to avoid each of these items being  identified as personal data. <br /><br />The definition of personal data in the DIFC  Data Protection Law refers to any information &ldquo;relating to&rdquo; an identifiable  natural person.&nbsp; For guidance on the scope of &ldquo;relating to&rdquo; in this context it  is useful to turn to the UK Information Commissioner&rsquo;s Office, who, in a 2007  report, expressed the view that data which identifies an individual, even  without a name associated with it, may be personal data where &ldquo;it is processed  to learn or record something about that individual, or where the processing of  the information has an impact upon that individual&rdquo;.&nbsp; For instance, a medical  history, a criminal record or a record of a particular individual&rsquo;s performance  at work or in a sporting activity will be data which is obviously about a  particular individual and it is the content of that information alone which  determines that it relates to an individual.&nbsp; That said, it will be necessary to  read that information in connection with the individual&rsquo;s name.&nbsp; Further, there  will be data which is not obviously about a particular individual but is  information about their activities, such as a person&rsquo;s personal bank statements  or itemized telephone bills.&nbsp; In these circumstances the data relates to the  person named on the statements or the bills and thus is personal data.&nbsp; The UK  Office suggested the following questions: &ldquo;Is the data being processed, or could  it easily be processed, to learn, record or decide something about an  identifiable individual? Or, as an incidental consequence of the processing,  either could you learn or record something about an identifiable individual, or  could the processing have an impact on or affect an identifiable individual?&rdquo;&nbsp;  If so, the data is likely to be personal data. <br /><br />An interesting scenario  is the minutes of a meeting held within an organization.&nbsp;There will be  circumstances where part of the record of a meeting will be personal data as the  data is obviously about or clearly linked to an individual.&nbsp;For instance,  consider where an individual&rsquo;s suitability for a particular role is discussed,  with consideration given to the individual&rsquo;s qualifications, personality and/or  performance.&nbsp; That section of the minutes of the meeting will be personal data  about that individual.&nbsp; If more than one candidate is considered in the meeting,  there may be personal data in the minutes of the meeting referable to each of  the identifiable individuals.&nbsp; The opinions of the people in the meeting about  the individuals in question will also be personal data of the individual being  discussed.&nbsp; If the meeting is actually to consider disciplinary action against a  particular employee, it is likely that everything discussed at the meeting and  recorded in the minutes is personal data about the individual.<br /><br />The  reports of the UK Information Commissioner&rsquo;s Office and publications of the  European Article 29 Working Party are not part of UAE law or the law of the  DIFC.&nbsp; However, when it comes to applying the DIFC Data Protection Law of 2007  on a day to day basis, it is useful to have regard to these external materials.&nbsp;  We look forward to further consideration of these topics by the DIFC Data  Protection Commissioner and the DIFC Courts in due course.</p>