Many people are accustomed to a situation in which they sign a permission to process and use their personal data. For example, this happens when participating in any advertising campaigns or when issuing special cards that give the right to receive discounts on the purchase of products and goods. Almost always you have to agree to use the information provided about yourself when applying for loans or other types of financial loans.
Quite often, the line informing about this does not even strike the eye. And this does not happen at all because it is printed in small print. The reason is that we are just used to it. Meanwhile, few people think that there are special categories of personal data. This means that not all information can be used. Even if the person provided it. Of course, certain information about yourself can be omitted.
What is personal data?
How to interpret this term? Before you know what personal data belongs to special categories, you need to understand what it is and have a clear idea of what falls under this definition and what does not.
The concept of this concept has developed quite a long time. Initially, in everyday life there was a different expression - “personal data”. However, now when processing any kind of documentation, forms or information leaflets, they use the word “personal”. Quite often, this expression is abbreviated to the abbreviation "PD". According to the definition, such information includes any information about a person and information about him. All this is provided to both legal entities and individuals.
In other words, personal data equally refers to information about the weight or color of the eyes, as well as information about nationality, education, place of work, etc. But about hobbies, taste preferences and any preferences - no.
This means that both ordinary and special categories of personal data are only objective information about a person. That is the one that is obvious. For example, the story that a person prefers a plate of borsch with sour cream for lunch does not belong to any of the categories. But information about growth, nationality, religion or eye color, diseases and other similar things - all this is personal data.
What can they be used for?
Data about a person is invaluable information. Thanks to it, manufacturers of any goods can understand much better which people are consumers of their products. And, accordingly, to optimize production, pricing policy, and, of course, the range of manufactured products, starting from the capabilities and needs of those who are the main consumers.
Thus, the collection of personal information about people is nothing more than a study of demand and opportunities for expanding the market. Of course, the economic sphere is far from the only area in which they are used.
Thanks to such data, various statistical reports are compiled, and the government relies on them when necessary. Various social organizations and funds, for example, pension, use personal information.
It uses personal data about a person and law enforcement officers. However, like criminals.
Which categories are special
Special categories of personal data include information regarding the following:
- the intimate side of a person’s life, his sexual orientation;
- current state of health and history;
- nationality, origin, family ties;
- political preferences; party affiliation;
- religious beliefs, beliefs.
Information related to professional activities or philosophical life beliefs may also fall under the category of “special”. However, do not confuse this with a life credo. For example, if a person is a rostoman, then such a philosophy can be included in special categories of personal data. This is a system of life values, beliefs, in many ways similar to religion. The same can be said of hippies or twisters. But if a person considers himself a hipster or punks, then such a life credo is not included in special categories of personal data. The list of characteristics should not be limited to taste preferences and specifics of appearance.
How is such information extracted and processed?
It is not always possible to use information about a person belonging to special categories. Even if the subject himself provided them, published or made public in another way.
Any use or processing of special categories of personal data is possible only with the written permission of a particular person. Moreover, the information that will be processed should be listed. This means that a sheet signed by a person must contain a detailed list of categories of personal data that will undergo any analysis or will be used in some other way.
This means that the person gives his written permission to act with specific information. For example, if a subject signs an act granting someone the right to use data about his health, then it is impossible to process information of a different kind, for example, regarding sexual orientation.
Processing special categories of personal data in banks is no exception. Financial institutions have the right to request and process only general information in the manner prescribed by law. If for any reason the bank needs to get access to one of the special categories and the possibility of using these data, then the employees of the institution are required to take written permission from the person. It should be executed on a separate page of the contract or as an independent act. Of course, there should be a clearly defined list of categories of information that the bank wishes to receive and process.
Under what circumstances can such information be processed and used?
There are certain circumstances in which you can receive personal information of any category. The subjects whose personal data will be used and processed, in some cases, may not even be informed about this.
Of course, such actions are possible only in exceptional situations and can only be carried out by special departments and services. For example, absolutely all personal data can be processed, analyzed and used by agencies that prevent terrorist acts.
Who else has access to special categories of personal information?
In addition to law enforcement officers and special services involved in the security of the state and its citizens, “peace” agencies can request, process and use this kind of information.
This right has:
- Pension Fund;
- institutions and services subordinate to the Ministry of Foreign Affairs, embassies;
- health authorities in the presence of a threat to human health and life;
- municipalities and other power structures;
- organizations dealing with guardianship or guardianship issues, providing assistance to minors in difficult situations;
- medical prophylactic and diagnostic centers conducting preventive examinations.
Public organizations, religious institutions, various social services can process, store and use special categories of personal data. This is carried out on general grounds specified by law. That is, with the written consent of the person whose personal data is planned to be analyzed, processed and used.
What is privacy protection?
This is a set of measures aimed at preventing or terminating any type of use of personal data to which the subject did not give written consent.
According to the intensity of protection, information is divided into groups. Each of them needs its own level of protection. Special categories of personal data belong to the most carefully guarded group - the first.
What are the levels of protection
Legislation provides for four basic levels of security for personal information.
In accordance with them, such groups or types of categories of personal data are distinguished:
- special;
- biometrics;
- publicly available;
- others.
Biometric data about a person includes characteristics such as photographs and fingerprints. The generally accepted information is considered to be information that people themselves provide access to. For example, publish data on social networks. Other information includes any information about a person that does not fit the criteria of other groups.
What types of processing exist
There are not as many as it seems. There are only two types, and they are determined by the presence of a connection with a person of those who use his personal data, regardless of whether they are legal entities or individuals.
The first type of personal data processing involves the use of information about a person:
- direct employer;
- a bank with which a financial agreement has been concluded;
- close relatives;
- attending physicians and so on.
That is, the first type of processing of personal data and their use combines the actions of legal entities or individuals directly related to the subject.
Accordingly, the second type is actions performed by persons who are not directly related to the subject.
Two types of processing are also legally separated. They depend on the volume used. And the categories of processed personal data with this separation do not matter. The first type includes the processing and use of data up to one hundred thousand, the second - above this level.
How threats are classified
All threats to which both special categories of personal data and any others can be exposed are divided into three types.
Separation is performed in accordance with only one parameter. This is a relationship to ISPD (personal data information system).
It is a repository of information about a person, within which the latter is processed. The system itself can be any - on paper and electronic media, using any technology or the method of "manual" processing. For example, the memory of the computer’s hard drive, where people’s personal data is collected, is exactly the same system storage as the cabinets in the archive building, filled with paper documents.
Thus, the division of attacks on personal data, their classification, is based on whether the person’s personal information is included in such a system or not.
What may be the assault
There are three topical types of threats to the security of personal information related to any ISPD:
- The presence in the software of undeclared capabilities that allow the use and processing of information outside a specific system.As a rule, this type of assault is directly related to those to whom information was provided.
- The presence in the ISPD of any additional element, component, which ensures the leakage of data subsequently processed and used externally.
- The presence of malicious intent and the participation of the notorious human factor. That is, the varieties of encroachments that enter into it are in no way connected with the system itself and the technologies used in it.
Typically, threat type descriptions are associated exclusively with virtual networks, computers, and other technologies. However, this is not a completely correct understanding. The system by which personal data is processed may also be something that is not related to them. For example, the home cabinet, in which the documents of family members are located, is also a repository of information that needs to be protected. Probable threats in this case fall under the third type of assault.
Why do you need to protect them?
As a rule, when questions about why it is necessary to ensure the security of personal information of people, most of them come up with something related to crime or terrorist acts. For example, stealing data about a specific person allows you to create a package of fake documents with which an attacker can infiltrate somewhere and get a chance to commit a criminal act.
Of course, the use of personal data for criminal purposes is an important argument in order to take care of their protection. However, in ordinary life, people are much more likely to encounter completely different consequences. This, for example, annoying targeted advertising, including by phone.
Also, unauthorized use of special categories of personal information can have negative individual consequences. For example, if information about sexual orientation, philosophical beliefs, or a person’s religion becomes public, this may affect the attitude towards him in society.
What is important for protecting data in special categories
It is not paradoxical, but most often the reason for the processing and use of personal information is the negligence of the person himself.
You should be vigilant and be extremely careful when filling out various questionnaires that indicate this kind of data. Providing information about yourself and signing the corresponding document, you need to carefully familiarize yourself with its contents and require re-issuance of the act in the event that something is in doubt or worries.