Knowing me, knowing you: Opinions, reputation, DNA and other entangled personal data

Abstract

It’s not uncommon for the same piece of personal data to relate to more than one individual. Opinions, feedback and reputation involve statements by one identifiable person about another; genetic data contain information about an individual, but also their relatives, ancestors and descendants; data about communications relate to both the sender and recipient; observations of one person may be used to make predictions about others. Privacy cases and papers have found these situations troubling, but analyse them by applying data protection law to a single data subject. This paper instead treats “entangled” personal data as involving multiple perspectives, examining how data protection principles apply simultaneously to different subjects of the same data. Where the perspectives are the same – as in a case on examination scripts – few problems are likely. Where there are significant differences this approach confirms the problems found by others but also suggests how these can be reduced: aligning the perspectives by changing data sources or processing, adopting voluntary limitations or safeguards. By quickly identifying problems that may not be apparent from a single-data-subject analysis, and identifying possible mitigations, an entangled analysis provides theoretical and practical guidance: suggesting safer ways to use this increasingly common form of personal data.