Identifying personal data in a report

1. Regulatory Concept & Core Standards

In this video we will work through a concrete decision: identify information enabling direct or indirect identification. The aim is to explain the criterion used and apply it to a workplace situation. We will start with the concept, move to the procedure and finish with a case to solve. Reports may contain information about reporters, persons concerned and bystanders. The GDPR, Latvian data-processing law and special reporting rules govern processing. Distinguish lawful handling from unjustified collection, sharing and retention.

Personal data include roles, shifts, locations and author metadata. Health and conviction information need specific legal assessment. Replacing names with codes does not automatically anonymise a file. Pseudonymisation reduces risk while identification may remain possible.

Apply the following rule: The law covers work-related information about breaches that may harm the public interest. It is not limited to the Directive’s listed EU-law fields. Purely personal grievances and knowingly false information are excluded; sections 2–3 also contain specific limits.

2. Practical Implementation & Procedure

Map forms, attachments, logs, outputs, people and purposes. Check GDPR articles 6,9 and 10 where relevant. Identify actual controller and processor roles rather than relying only on contract labels. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A staff number is linked to a name through a departmental table. The record remains personal data and requires access control. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does a number remove privacy duties? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Identifiability using additional information remains relevant. Pseudonymisation can reduce risk without eliminating duties.

One mistake to avoid is: equating a replacement code with complete anonymisation.

Now apply the national rule to a second decision. A report is automatically recognised as protected because it contains the word corruption. What check is missing?

Check work context, possible public-interest harm, belief in truth and statutory conditions. A category does not replace sections 1–3 assessment. A personal complaint may also contain a public-interest breach; assess facts rather than title. Record reasons and necessary clarification.