Large Scale Data Processing Explained

Large Scale Data Processing is one of the main reasons why organisations must have a Data Protection Officer (DPO).

The Information Commissioner’s Office (ICO) asks two questions:

“Do your organisation’s core activities involve tracking and monitoring people’s behaviour (for example on the internet, or on CCTV) on a large scale?”

and

“Do your organisation’s core activities involve processing on a large scale ‘special categories’ of personal data, or large scale criminal convictions or offences data?”

If the answer to either is ‘yes’ then you must have a DPO and register their details with the ICO.

What is tracking or monitoring people’s behaviour?

Monitoring is defined as the analysis or prediction of behaviour, location, movements, interests, personal preferences, performance, for any purpose.

This will apply to both employees and customers. A good example of monitoring people’s behaviour is the use of trackers on company vehicles. It is reasonable to do this so you can know where those vehicles are at all times. However, this will also involve tracking the location of the people driving those vehicles.

What are special category data?

Under the GDPR personal data is defined as “anything that by itself or in combination with other data allows a person to be identified.”

Within the GDPR’s broad definition of personal data, there is a subset of data that gets more protection. The GDPR calls this “special category data”. It is helpful to think of this as sensitive personal data, as it is the kind of information that is more likely to lead to discrimination, or other forms of harm, if there is a data breach.

Sensitive classes of data include anything involving processing of or revealing:

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data
• biometric data like fingerprints or retinal scans (where used for identification purposes)
• health
• a person’s sex life
• sexual orientation.

Special category data has additional protections. Additional care has to be taken to process it lawfully, and to keep it safe and secure.

Examples of Processing Special Category Data and Criminal Offence Data

Employers will process special category data if they provide occupational health services to their employees. They may do this, for example, to manage sickness absence or to make adjustments for employees with disabilities.

They will also process criminal offence data on a large scale if they require all employees to undergo a criminal offence check via the Disclosure and Barring Service.

What is “large scale”?

Most people will say ‘it depends’ because it is more context specific than a fixed number or threshold. But there are three simple questions you can ask yourself to work out the answer for your organisation.

1. Is the core of your business activity based on location or activity data? For example, you might run a car park that uses number-plate recognition and length of stay data to charge for parking. This is very different to having CCTV in your office car-par for crime prevention and detection purposes, but which is not a core business activity.

2. Do you do this type of processing systematically? That is do you generally do it for everyone you come into contact with or only for some people or for some of the time? If this kind of processing is done from time to time, perhaps for specific roles or for a particular time-limited research project you do not do it systematically.

3. Do you process data of this type for a relatively large number of people? Or keep the data for a long time? Do it take a significant proportion of your organisations time or electronic resources? This is a slightly different question than the one about core business activity. This is because the answer here is ‘yes’ even if your processing is incidental. For example, if you have CCTV that monitors a large publicly accessible area such as a shopping centre you will capture the data of many people whether you use it for anything or not.

Similarly if you retain data for a very long time – a period of years – then the length of time you keep the data for will be considered large scale.

So, in short, you will need a DPO if you do it for one or more of the following:

• process sensitive or special category personal data; or
• as part of your core business activities; or
• systematically for all of the people you come into contact with; or
• you collect or process data for a relatively large number of people or over a wide geographical area; or
• it takes a significant part of your organisation’s resources, whether physical or electronic; or
• you retain relevant data for a relatively long period of time.

Large Scale Data Processing: What to Do?

If there is any chance you process special category data or do so on a large scale you should appoint a Data Protection Officer. There are a number of effective and efficient ways of doing this (click here for more) and it does not change to fee you must pay to the ICO to register as a data controller (which you can do here).

Three Free Things You Can Do Right Now

To improve your understanding of the GDPR and improve your compliance you can do any or all of the following:

• sign up to the WuDo Solutions newsletter for regular articles like this, advice, tool and regular offers direct to your inbox
• attend our free events to learn more about GDPR and pose queries to our team of experts
• have a no obligation discussion about your needs, be it finding a Data Protection Officer, training, or something else