Definition of Personal Data

Personal data is defined in Article 183 of the Digital Code Law and listed in eight different categories:

1. Personal identification data, in particular: first name, surname, middle name, date and place of birth, age, marital status, national identification number, valid official identity document or any other biometric data, in particular photographs, sound recordings, images, fingerprints and iris scans;
2. Correspondence data: telephone numbers, physical, postal and e-mail addresses;
3. Professional data: status, job held, employer, remuneration;
4. Billing and payment data: invoice amounts and history, payment status, reminders, payment balances, direct debit date;
5. Bank details: bank code, account and credit card number, bank name / address / contact details, transaction references;
6. Data on legal entities under public or private law showing personal data;
7. Data on family circumstances; and
8. Data concerning court decisions.

Definition of Sensitive Personal Data

There is no separate definition of sensitive data, but the Digital Code prohibits, as a matter of principle, the processing of certain data which can be considered as sensitive, such as personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, the status of refugees or stateless persons, trade union membership, sex life or, more generally, data relating to the state of health.

For the purposes of this definition, “processing” is to be understood as the operation or set of operations which is performed upon personal data, whether by means of wholly or partly automated processes, such as collection, recording, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

There are several exceptions to this principle stated in the Digital Code. The processing of such data will be admissible should, for instance, one consents to such processing for a well determined purpose. The processing of such data for statistical analysis or health reasons will usually, and within the boundaries of the Law, be equally accepted.