The One Dataset Too Far: A Practical Privacy & Data Protection Primer

Use these definitions to decide whether GDPR applies and which governance obligations are triggered.

• Personal data: any information about an identified or identifiable natural person (IP addresses, device IDs, and precise location all qualify).
• Not personal data: information solely about a legal person (e.g., a company registration number) unless it identifies a sole trader or enables re-identification.
• Special category data: race/ethnicity, political opinions, religion, union membership, genetic/biometric, health, sex life, or sexual orientation.
• Direct identifiers vs quasi-identifiers: direct identifies alone (name, email); quasi identifies only when combined (DOB + ZIP + gender).
• Pseudonymization: replace identifiers with a key; still personal data under GDPR.
• Anonymization: data is no longer identifiable using means reasonably likely to be used (WP29/EDPB threshold).
• DPO core activities: operations essential to the controller/processor mission, not ancillary HR or IT support.
• Regular and systematic monitoring: ongoing, recurring tracking or profiling of individuals.
• Large-scale factors: number of data subjects, volume/variety, duration, and geographic scope.

• Identity: name, account IDs, government ID numbers, signatures.
• Contact: email, phone, postal address, support tickets.
• Tracking: cookies, device IDs, ad IDs, fingerprinting signals, analytics IDs.
• Location: precise GPS, IP-derived city/region, Wi-Fi/Bluetooth beacons.
• Financial: bank details, card tokens, invoices, payroll, credit scoring.
• Health-adjacent: wellness metrics, symptoms, medication reminders (may become special category when linked to health).
• Employment/Education: job title, performance notes, grades, student IDs.
• Children/Family: age, guardian data, household composition.
• Security/Audit: access logs, MFA events, admin actions, IP logs.

• GDPR accountability model: controllers own lawful basis, documentation, minimization, privacy by design, and data subject rights; processors implement security and follow documented instructions.
• U.S. sectoral patchwork: obligations depend on sector/data type, with the FTC enforcing privacy via unfair or deceptive practices when promises are broken or security is unreasonable.
• China PIPL tension: strong consumer-facing rights and strict cross-border transfer rules, paired with broad state security access and no GDPR-style legitimate interests basis.

• DPO mandatory (Art 37): public authorities, or core activities involving regular/systematic monitoring on a large scale, or large-scale processing of special category or criminal data.
• DPO independence (Art 38): reports to highest management, no instruction on tasks, protected from dismissal, and resourced with access to data and operations.
• DPO tasks (Art 39): inform/advise, monitor compliance, train staff, advise on DPIAs, cooperate with the supervisory authority, and act as contact point.
• Conflicts of interest: DPO cannot hold roles determining purposes/means (e.g., Head of Marketing, HR, or IT/CIO); voluntary DPOs still must meet Art 37-39 duties.
• DPIA (Art 35): evaluate necessity/proportionality and risks of high-risk processing, documenting mitigations before launch.
• Breach notification (Art 33): notify supervisory authority within 72 hours of awareness; notify data subjects without undue delay when risk is high (Art 34).
• Privacy by design/default (Art 25): minimize data, default to least-invasive settings, and embed safeguards into systems.
• Security measures (Art 32): encryption, access controls, resilience, backup, and regular testing aligned to risk.
• Principles: accuracy, data minimization, purpose limitation, storage limitation, integrity/confidentiality, accountability.
• Max fine (Art 83): up to EUR 20M or 4% of global annual turnover, whichever is higher.

• FTC: primary privacy enforcer through Section 5 (unfair or deceptive practices), especially when security promises are broken.
• GLBA: financial institutions must give privacy notices and allow opt-out before sharing nonpublic personal information with non-affiliated third parties (with service-provider exceptions).
• HIPAA: applies to covered entities and business associates; many fitness or wellness apps are outside HIPAA unless they handle covered-entity data.
• COPPA: verifiable parental consent is required before collecting personal data from children under 13.
• CCPA/CPRA: applies to for-profit businesses doing business in CA with more than $25M annual gross revenue (or other statutory thresholds), granting access/delete/opt-out rights.
• CPRA sensitive personal information: consumers can limit use/disclosure of precise geolocation, health data, ID numbers, and similar SPI.

• k-anonymity: each record is indistinguishable from at least k-1 others across quasi-identifiers.
• Quasi-identifiers vs direct identifiers: direct identifies alone (email); quasi identifies only when combined (ZIP + DOB + gender).
• Massachusetts GIC linkage attack: anonymized health data was re-identified by linking to voter rolls (Sweeney).
• Generalization: reduce precision (age ranges instead of DOB) to increase k.
• Noise addition: perturb values or inject randomness to reduce linkage risk.
• Differential privacy goal: bound how much any single individual's data can change outputs.
• Pseudonymization remains personal data; anonymization must survive the 'means reasonably likely' re-identification test (WP29/EDPB).

• 0-4 hours: isolate infected hosts, stop lateral movement, preserve evidence (logs, memory, disk snapshots), and keep chain of custody.
• 4-24 hours: scope affected systems, identify data categories, notify incident lead/DPO/legal, engage forensics, validate backups.
• 24-72 hours: assess risk to individuals, draft supervisory authority notification within 72 hours of awareness (Art 33), prepare data subject notices if high risk.
• 72+ hours: coordinate law enforcement/insurer, eradicate malware, rotate credentials, recover services, and publish a post-incident review.

• Q1. Is an IP address personal data under GDPR?
• Q2. Is a company registration number personal data in all cases?
• Q3. Name two examples of special category data.
• Q4. Name the three Art 37 triggers that make a DPO mandatory.
• Q5. What does DPO independence (Art 38) require?
• Q6. List two DPO tasks from Art 39.
• Q7. Give one example of a DPO conflict of interest.
• Q8. Does appointing a voluntary DPO trigger Art 37-39 duties?
• Q9. What is the purpose of a DPIA (Art 35)?
• Q10. What does the GDPR 72-hour rule apply to?
• Q11. Which article covers privacy by design/default?
• Q12. Which article covers security measures?
• Q13. Name two GDPR principles (e.g., accuracy, minimization).
• Q14. What is the maximum GDPR administrative fine?
• Q15. What is the difference between anonymization and pseudonymization?
• Q16. What is the WP29/EDPB anonymization threshold?
• Q17. Define k-anonymity in one sentence.
• Q18. What is a quasi-identifier?
• Q19. What did the Massachusetts GIC linkage attack show?
• Q20. Name two anonymization techniques besides k-anonymity.
• Q21. What is the goal of differential privacy?
• Q22. How is the U.S. privacy model structured?
• Q23. What standard does the FTC use to enforce privacy?
• Q24. GLBA opt-out applies to sharing with whom?
• Q25. HIPAA applies to which entities?
• Q26. What does COPPA require for children under 13?
• Q27. Name the CCPA/CPRA revenue threshold trigger.
• Q28. What right does CPRA give for sensitive personal information?
• Q29. Describe the China PIPL tension in one line.
• Q30. In ransomware response, name three immediate actions.

• A1. Yes, IP addresses are personal data if they can identify a person directly or indirectly.
• A2. No; a company registration number is usually not personal data unless it identifies a natural person (e.g., sole trader).
• A3. Examples: health data, biometric data, political opinions, religious beliefs, sexual orientation.
• A4. Public authority; regular/systematic monitoring on a large scale; large-scale processing of special category or criminal data.
• A5. DPO must report to top management, act independently, and not be instructed or penalized for performing DPO tasks.
• A6. Inform/advise, monitor compliance, train staff, advise on DPIAs, cooperate with the authority, be a contact point.
• A7. Roles that determine purposes/means (e.g., Head of Marketing, HR, IT/CIO).
• A8. Yes; voluntary DPOs must meet Art 37-39 duties.
• A9. Assess necessity/proportionality and risks of high-risk processing and define mitigations before launch.
• A10. Notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
• A11. Article 25.
• A12. Article 32.
• A13. Accuracy, data minimization, purpose limitation, storage limitation, integrity/confidentiality, accountability.
• A14. Up to EUR 20M or 4% of global annual turnover, whichever is higher.
• A15. Anonymization is irreversible; pseudonymization replaces identifiers but remains personal data.
• A16. Data must not be identifiable using means reasonably likely to be used (WP29/EDPB).
• A17. Each record shares the same quasi-identifier values with at least k-1 other records.
• A18. A data point that identifies a person only when combined with other data (e.g., ZIP + DOB + gender).
• A19. That linkage to external datasets can re-identify supposedly anonymized records.
• A20. Generalization and noise addition (also suppression, aggregation, swapping).
• A21. Limit how much any single individual's data can influence outputs.
• A22. Sectoral patchwork of federal/state laws by data type/industry.
• A23. Section 5 unfair or deceptive practices.
• A24. Non-affiliated third parties (subject to exceptions).
• A25. Covered entities and their business associates.
• A26. Verifiable parental consent before collection.
• A27. For-profit businesses doing business in CA with >$25M annual gross revenue.
• A28. Right to limit use/disclosure of sensitive personal information.
• A29. Strong consumer rights but broad state security access and no GDPR-style legitimate interests basis.
• A30. Isolate systems, preserve evidence, and report/notify as required.