Privacy, Data Protection and Digital Identity

Introduction and context

Digital services depend on information about identifiable people. A bank verifies a customer’s identity, a university records student progress, a hospital manages clinical information, and an online platform analyses behaviour to recommend content. These activities create social and economic value, but they also create risks: surveillance, discrimination, identity theft, manipulation, embarrassment, financial loss and exclusion from essential services.

Privacy and data protection law provide rules for managing these risks. Privacy is a broad human and social interest in personal space, autonomy, confidentiality and control over information. Data protection is the legal and organisational framework governing the collection, use, disclosure, storage and deletion of information relating to individuals. Digital identity concerns the representation of a person in electronic systems and the methods used to establish, authenticate and attribute that identity.

This chapter uses general principles found in major data-protection systems, including the European Union General Data Protection Regulation (GDPR), while recognising that national laws differ. The GDPR is used as an influential comparative framework, not as a substitute for consulting the law applicable in a particular jurisdiction.

Learning objectives

By the end of this chapter, you should be able to:

• distinguish personal data, sensitive or special-category data, anonymous data and pseudonymous data;
• explain the roles of data subject, controller, processor and recipient;
• identify lawful bases for processing and assess the quality of consent;
• apply transparency, purpose limitation, data minimisation, accuracy, retention and security principles;
• describe major data-subject rights;
• explain profiling, automated decision-making, biometrics and children’s privacy;
• outline issues in international data transfers and digital identity systems; and
• recommend privacy-by-design and privacy-by-default measures.

1. The data-protection vocabulary

Personal data

Personal data is information relating to an identified or identifiable natural person. Identification may be direct, such as through a name or passport number, or indirect, such as through an employee number, device identifier, location history or combination of attributes. A person may be identifiable even when a dataset contains no name. For example, a rare job title, postcode and date of birth may identify one individual when combined with other information.

Personal data can include:

• names, addresses, telephone numbers and email addresses;
• identification numbers and account credentials;
• photographs, voice recordings and video footage;
• IP addresses, cookie identifiers and mobile advertising identifiers;
• location, browsing, purchasing and transaction records;
• employment, education and financial information; and
• inferences, such as an estimated income, risk score or interest category.

The important question is not only what the organisation knows, but whether the information relates to a person who can reasonably be identified.

Sensitive or special-category data

Some information creates heightened risks and is therefore subject to additional protection in many legal systems. Under the GDPR, special categories include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health data, and information about sex life or sexual orientation. Criminal-conviction data is also subject to special rules, although it is treated separately from the special categories.

The label “sensitive data” may have a different statutory meaning in other countries. Organisations should therefore consult the applicable legislation rather than assume that an informal classification is legally sufficient. Sensitivity can also arise from context. A seemingly ordinary location record may reveal attendance at a medical clinic or place of worship.

Anonymous and pseudonymous data

Anonymous data cannot reasonably be linked to an individual using means likely to be used by the organisation or another relevant party. Proper anonymisation is difficult: removing names is not enough if people can be re-identified by combining datasets.

Pseudonymised data replaces direct identifiers with a code. The additional key is kept separately, but re-identification remains possible. Pseudonymised information is generally still personal data, although pseudonymisation can reduce risk and support security, testing and research.

The principal actors

A data subject is the individual to whom personal data relates. A controller decides why and how data is processed. A processor handles data on behalf of a controller, usually under a contract or other legal instrument. A processor must follow documented instructions and maintain appropriate security, but the controller remains responsible for selecting and supervising it.

Where organisations jointly determine purposes and means, they may be joint controllers. A recipient is an organisation or person to whom data is disclosed. These roles should be documented because legal duties, contracts and accountability depend on them.

2. Lawful processing and accountability

“Processing” is a broad term covering collection, recording, organisation, storage, alteration, retrieval, consultation, disclosure, use, combination, restriction and deletion. Processing normally requires a lawful basis.

Common lawful bases

The GDPR illustrates six widely recognised bases for ordinary personal data:

A lawful basis should be selected before processing begins. An organisation should not collect data first and decide later which basis appears convenient. The basis should be recorded in a processing register or comparable accountability documentation.

Special-category data normally requires both an ordinary lawful basis and an additional condition, such as explicit consent, employment-law necessity, vital interests where the person cannot consent, substantial public interest, healthcare, public-health necessity or scientific research under appropriate safeguards.

Consent

Valid consent is more than clicking “I agree”. It should be freely given, specific, informed and unambiguous. A request should be intelligible, separate from unrelated terms, and presented in clear language. Consent is weak where the person has no realistic choice, where a service is unnecessarily conditional on agreement, or where refusal produces unfair consequences.

Pre-ticked boxes, silence and inactivity normally do not demonstrate affirmative consent. Withdrawal should be as easy as giving consent. Organisations should retain evidence of what was presented, when consent was obtained and how it can be withdrawn.

Legitimate interests and balancing

Where legitimate interests is relied upon, a practical three-part assessment is useful:

1. Identify a real and lawful interest.
2. Ask whether the processing is necessary for that interest and whether a less intrusive method would work.
3. Balance the interest against the individual’s rights, expectations, vulnerability and likely impact.

A security camera at an entrance may be proportionate for access control, while continuous facial recognition throughout a public space may produce a much greater interference and require stronger justification or prohibition.

Fairness, purpose limitation and minimisation

Fair processing requires attention to power, expectations and consequences, not merely formal legality. Data should be collected for specified, explicit and legitimate purposes and not reused for incompatible purposes without a new justification. Data minimisation means collecting data that is adequate, relevant and limited to what is necessary.

For example, a delivery service may need an address and contact number. It may not need a customer’s complete contact list or unrelated health history. Minimisation reduces breach impact, storage costs and opportunities for misuse.

Accuracy, security and accountability

Inaccurate data can cause denial of credit, incorrect medical treatment or wrongful suspicion. Organisations should take reasonable steps to keep data accurate and allow correction.

Security should be appropriate to risk. Measures may include access control, multi-factor authentication, encryption in transit and at rest, secure key management, logging, vulnerability management, backups, staff training, supplier controls and incident-response plans. Security is not identical to privacy: a perfectly secure system may still collect excessive data for an unjustified purpose.

Accountability requires evidence that principles were considered and implemented. Useful records include data maps, lawful-basis assessments, privacy notices, retention schedules, contracts, impact assessments, training records and breach logs.

3. Transparency and data-subject rights

Privacy notices

A privacy notice should explain, in accessible language, who is processing the data, the purposes, categories of data, lawful basis, recipients, international transfers, retention period or criteria, rights, complaint routes, automated decision-making and contact details. Layered notices can present a short summary with links to fuller information. Transparency must occur at the appropriate time, including when data is obtained indirectly.

A notice is not transparent merely because it is technically complete. Excessive length, vague purposes such as “business improvement”, confusing interfaces and contradictory statements may conceal rather than communicate.

Principal rights

Depending on the legal system and applicable exceptions, individuals may have the following rights:

• Access: obtain confirmation that data is processed and receive a copy with relevant information.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion in specified circumstances, subject to legal retention and freedom-of-expression exceptions.
• Restriction: require processing to be limited while accuracy, lawfulness or objections are considered.
• Data portability: receive certain information in a structured, commonly used, machine-readable format and transmit it to another controller where the legal conditions apply.
• Objection: object to processing based on legitimate interests or public task, and object to direct marketing, including related profiling.
• Rights concerning automated decisions: receive safeguards and, in relevant circumstances, human intervention, an opportunity to express a view and a right to challenge a decision.

Rights are not absolute. Identity verification, security, legal privilege, statutory retention and the rights of others may affect how a request is handled. Organisations should have procedures for authentication, searching systems, recording decisions and responding within statutory deadlines.

4. Retention, profiling and automated decisions

Retention

The storage-limitation principle requires personal data to be kept no longer than necessary for the purpose. Retention is not automatically justified because storage is inexpensive. A retention schedule should identify the purpose, legal or operational requirement, review date, archive status and secure disposal method.

Retention may be extended where tax, employment, limitation or regulatory laws require records to be preserved. Such data should generally be access-restricted and separated from active systems. Deletion must include relevant databases, backups, test environments, paper records and supplier-held copies where feasible.

Profiling

Profiling involves automated processing to evaluate or predict aspects of a person, such as performance, reliability, health, preferences, behaviour, location or economic situation. It can support fraud detection and personalisation, but it can also reproduce historical bias, infer sensitive traits and limit opportunities without meaningful explanation.

A responsible profiling assessment asks:

• What data and inferences are used?
• Is the purpose lawful and expected?
• How accurate is the model, and how often is it reviewed?
• Are different groups affected differently?
• Can a person obtain an explanation or challenge the result?
• Is a human reviewer genuinely able to change the outcome?

A human merely approving an automated result without examining it is not meaningful human intervention.

5. Biometrics and children’s privacy

Biometric data includes physical, physiological or behavioural characteristics processed for identification, such as fingerprints, facial templates, iris patterns, voice characteristics or gait. Biometrics can improve convenience and prevent some forms of fraud, but biometric identifiers are difficult or impossible to replace after compromise. A password can be changed; a face cannot.

Organisations should first consider less intrusive alternatives. If biometrics are necessary, they should define the purpose narrowly, protect templates rather than raw images where possible, use liveness and anti-spoofing controls, limit retention, test demographic performance, provide alternatives and conduct a privacy or data-protection impact assessment. Biometric matching for unique identification may receive special-category treatment and may be prohibited or tightly regulated in public spaces.

Children may have reduced capacity to understand data practices and may be especially vulnerable to profiling, advertising, coercion and permanent reputational effects. Services directed to children should use age-appropriate language, avoid manipulative design, limit behavioural advertising, collect only necessary information and obtain parental authorisation where required. Age assurance itself creates privacy risks: collecting identity documents from every visitor may be disproportionate. Privacy-preserving age-estimation or token-based systems may reduce data exposure, but they must be accurate, inclusive and legally authorised.

6. Digital identity

Digital identity is the collection of attributes, credentials and processes used to represent an individual electronically. It involves three related activities:

• Identity proofing: establishing that a person corresponds to claimed identity attributes.
• Authentication: testing whether a person controls a credential or authenticator.
• Authorisation: determining what an authenticated person may do.

These must not be confused. A strong password authenticates control of an account; it does not necessarily prove a person’s legal identity. Identity proofing may use documents, databases, in-person checks or biometrics. Authentication may use knowledge factors, possession factors, inherence factors or combinations of these.

Digital identity systems should follow proportionality. A service requiring access to a public timetable does not need the same identity evidence as a high-value banking transaction. Excessive identity requirements create exclusion, enable tracking and produce attractive targets for attackers.

Federated identity allows one identity provider to authenticate a user for multiple relying parties. It can reduce repeated collection of identity data, but creates concentration risk and requires clear allocation of responsibility. Selective disclosure and verifiable credentials can allow a person to prove a limited claim—for example, that they are over a required age—without revealing a full birth date. These technologies are promising, but governance, revocation, interoperability, accessibility and redress remain essential.

7. International transfers

Cloud services, global employers and multinational platforms frequently move personal data across borders. Transfer rules may require an adequacy decision, approved contractual safeguards, binding corporate rules, certification mechanisms or a specific derogation, depending on the jurisdiction.

A transfer assessment should examine the destination country’s legal environment, government-access risks, the data involved, the purpose, the importer, technical safeguards and the possibility of effective remedies. Encryption, pseudonymisation, access restrictions and split processing may reduce exposure, but technical measures cannot always cure a legal conflict if a foreign recipient must provide intelligible data to authorities.

Contracts should address confidentiality, security, sub-processors, assistance with rights requests, incident notification, deletion or return, audits and onward transfers. Transfer compliance is an ongoing governance activity, not a one-time clause in a contract.

8. Privacy by design and by default

Privacy by design integrates privacy into architecture, procurement, software development and organisational decisions from the beginning. Privacy by default means that, without an active choice, the system should collect, expose and retain only what is necessary.

A practical lifecycle is:

1. Define the purpose and legal basis.
2. Map data flows, actors, systems and jurisdictions.
3. Identify threats, harms and affected groups.
4. Compare less intrusive alternatives.
5. Build controls into requirements and architecture.
6. Test security, usability, accessibility, bias and rights handling.
7. Monitor, audit and revise as purposes or technology change.

Examples include local processing instead of central collection, granular permissions, short default retention, role-based access, pseudonymous identifiers, user dashboards, privacy-preserving analytics, encryption, deletion workflows and clear consent controls. A data-protection impact assessment is especially valuable for systematic monitoring, large-scale sensitive data, vulnerable groups, biometrics or high-risk automated decisions.

Privacy engineering should address the full data lifecycle: collection, use, sharing, storage, backup, archival and destruction. “Collect now and secure later” is a poor strategy because future uses, breaches and legal changes cannot be predicted reliably.

9. Applied case: a university biometric attendance system

Background

This illustrative case concerns Northbridge College, which proposes facial-recognition attendance for large introductory classes. The college argues that manual registers are slow and that automated attendance will reduce fraudulent sign-ins.

Problem

The proposal would create biometric templates for 4,000 students, including minors in a foundation programme. Students would be required to use the system, and the vendor would retain images for five years. The initial notice says the data will be used for “campus improvement and security”.

Analysis

The college is likely a controller and the vendor a processor, although their actual responsibilities must be assessed. Facial templates used for unique identification may be special-category biometric data. The stated purpose is vague and appears to combine attendance, security and future uses. Five-year retention is difficult to justify for a daily attendance function. Mandatory participation may undermine freely given consent, particularly where students have little practical alternative.

The proposal also presents accuracy and fairness risks. False matches may wrongly mark students absent, while performance may vary across demographic groups. A breach could cause lasting harm because biometric characteristics cannot simply be reissued. The college should consider whether ordinary identification cards, rotating attendance codes or teacher verification would achieve the purpose with less intrusion.

Approach and solution

The college conducts a data-protection impact assessment and consults students, disability representatives, staff and its regulator. It rejects facial recognition for routine attendance and adopts rotating, time-limited attendance codes supplemented by random manual checks. Students who cannot use smartphones receive paper or card-based alternatives. Attendance records are retained only for the academic and legal period required, then deleted or aggregated.

If biometric access control is later considered for a genuinely high-risk laboratory, it must have a separate purpose assessment, a non-biometric alternative, strict access controls, template protection, short retention, accuracy testing and independent review. The vendor contract must prohibit secondary use and require deletion at termination.

Outcome and learning points

The revised system meets the attendance objective with less sensitive data, reduces exclusion and avoids creating a large biometric database. The case demonstrates that privacy is not simply a compliance check after procurement. Purpose definition, necessity, proportionality, alternatives, retention, children’s interests and meaningful choice should shape the original design.

10. Challenges, ethics and contemporary developments

Data protection involves unavoidable tensions. Fraud prevention may require information that creates surveillance risk. Personalisation may improve services while encouraging manipulation. De-identification may support research but fail under linkage attacks. AI systems can infer sensitive information from apparently ordinary data and may make decisions that are difficult to explain.

Organisations should not treat compliance as a guarantee of ethical legitimacy. A practice may satisfy a notice requirement yet still be unfair, discriminatory or socially harmful. Governance should include senior responsibility, independent review, affected-person consultation, complaint channels and measurable controls.

Generative AI and large-scale machine learning intensify familiar problems. Training data may contain personal information; prompts may disclose confidential records; model outputs may reproduce sensitive inferences; and retention by providers may be unclear. Organisations should establish approved-use rules, prohibit unnecessary personal data in prompts, assess suppliers, test outputs, maintain human accountability and provide routes to correct or challenge consequential decisions.

The most reliable general principle is proportionality: use the least personal, least identifiable and least persistent information capable of achieving a legitimate objective, while preserving security, fairness and access to remedy.

Chapter Summary

Privacy concerns autonomy, dignity, confidentiality and control over personal information, while data protection supplies enforceable principles and organisational duties. Personal data includes direct identifiers, indirect identifiers, online identifiers and inferences. Sensitive or special-category data requires heightened safeguards. Pseudonymisation reduces risk but normally does not remove data-protection obligations.

Lawful processing requires an appropriate basis, and consent must be informed, specific, freely given and withdrawable. Fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability apply throughout the data lifecycle. Data subjects may have rights of access, correction, deletion, restriction, portability and objection, together with safeguards concerning automated decisions.

Retention schedules, impact assessments and privacy-by-design practices help convert principles into operational controls. Profiling, biometrics, children’s data, international transfers and digital identity require particular attention to necessity, proportionality, accuracy, security, inclusion and redress. Effective privacy governance combines legal analysis, technical safeguards, ethical judgment and meaningful oversight.

Key Terms

Personal data: Information relating to an identified or identifiable natural person.

Sensitive or special-category data: Data receiving heightened legal protection because of its potential impact or intimate nature.

Data subject: The individual to whom personal data relates.

Controller: The person or organisation deciding the purposes and means of processing.

Processor: An organisation processing data on behalf of a controller.

Processing: Any operation performed on personal data, including collection, use, disclosure and deletion.

Pseudonymisation: Replacing identifiers with codes while retaining a means of possible re-identification.

Anonymisation: Processing intended to make identification no longer reasonably possible.

Lawful basis: A legally recognised justification for processing personal data.

Consent: A freely given, specific, informed and unambiguous indication of agreement.

Purpose limitation: Using data only for specified, legitimate and compatible purposes.

Data minimisation: Limiting collection and use to what is necessary and relevant.

Retention: The period for which information is stored or otherwise maintained.

Profiling: Automated processing used to evaluate or predict personal characteristics or behaviour.

Biometric data: Data about physical, physiological or behavioural characteristics used for identification or verification.

Identity proofing: Establishing that claimed identity attributes correspond to a person.

Authentication: Verifying control of an account or credential.

Privacy by design: Integrating privacy safeguards into systems and processes from the outset.

Data-protection impact assessment: A structured assessment of high-risk processing and mitigating measures.

International transfer: Making personal data available across national or regional legal boundaries.

Review Questions

Short Answer Questions

1. What is the difference between personal data and pseudonymised data?
2. Identify three lawful bases for processing ordinary personal data.
3. Why is data minimisation important?
4. Distinguish identity proofing from authentication.
5. State two risks associated with biometric identification.

Long Answer Questions

1. Explain the principles of purpose limitation, accuracy, storage limitation and accountability, using practical examples.
2. Discuss the requirements for valid consent and explain why consent may be inappropriate in an unequal relationship.
3. Describe the principal data-subject rights and the circumstances in which they may be limited.
4. Explain how profiling and automated decision-making can create fairness and transparency risks.
5. Discuss privacy by design and privacy by default across the data lifecycle.

Analytical / Application Questions

1. A retail app requests a customer’s contacts, precise location and date of birth to provide discount coupons. Analyse necessity, lawful basis, transparency and minimisation, and recommend a less intrusive design.
2. An employer wants to use facial recognition to monitor attendance. Apply proportionality, children’s or vulnerable-person considerations where relevant, security, retention and alternatives to decide whether the proposal should proceed.
3. A cloud provider stores customer records in another country and uses an AI service to analyse them. Identify the principal transfer, processor, transparency, security and automated-processing issues that the organisation should assess before deployment.

Multiple Choice Questions with Answers

Question 1

Which statement best describes pseudonymised data?

A. It can never be linked to a person under any circumstances.

B. Direct identifiers are replaced, but re-identification may remain possible.

C. It is data that has been deleted from all backups.

D. It is information that relates only to companies.

Correct Answer: B. Direct identifiers are replaced, but re-identification may remain possible.

Question 2

Which is generally required for valid consent?

A. Silence after receiving a privacy notice

B. A pre-ticked acceptance box

C. A freely given, specific and informed affirmative indication

D. Consent that cannot later be withdrawn

Correct Answer: C. A freely given, specific and informed affirmative indication

Question 3

What is the main purpose of data minimisation?

A. To retain all potentially useful data indefinitely

B. To collect only data that is adequate, relevant and necessary

C. To prevent individuals from accessing their data

D. To replace encryption with notice requirements

Correct Answer: B. To collect only data that is adequate, relevant and necessary

Question 4

Which actor normally decides why and how personal data is processed?

A. Data subject

B. Processor

C. Controller

D. Authentication device

Correct Answer: C. Controller

Question 5

Which example is most likely to involve biometric data used for identification?

A. A postal address

B. A facial template used to recognise a person

C. A generic weather report

D. A company registration number

Correct Answer: B. A facial template used to recognise a person

Question 6

What is a key concern with retaining personal data longer than necessary?

A. It always improves accuracy

B. It increases potential exposure and may breach storage-limitation principles

C. It automatically makes the data anonymous

D. It removes the need for access controls

Correct Answer: B. It increases potential exposure and may breach storage-limitation principles

Question 7

Which activity is identity proofing?

A. Checking whether a person controls a password

B. Deciding what an authenticated user may access

C. Establishing that identity documents correspond to the claimant

D. Deleting an inactive account

Correct Answer: C. Establishing that identity documents correspond to the claimant

Question 8

Which measure best reflects privacy by default?

A. Making all profile information publicly visible initially

B. Collecting the maximum data in case it becomes useful

C. Starting with limited collection, access and retention unless the user actively chooses otherwise

D. Disabling all security logging

Correct Answer: C. Starting with limited collection, access and retention unless the user actively chooses otherwise

Question 9

Why can children require additional privacy safeguards?

A. They are never data subjects under privacy law

B. They may have less capacity to understand consequences and may be more vulnerable to manipulation

C. Their data is automatically anonymous

D. Children cannot use digital services lawfully

Correct Answer: B. They may have less capacity to understand consequences and may be more vulnerable to manipulation

Question 10

What should an organisation generally do before transferring personal data internationally?

A. Ignore the destination country because cloud storage is exempt

B. Assess the legal transfer mechanism, risks, safeguards and remedies

C. Publish the data publicly first

D. Delete the privacy notice

Correct Answer: B. Assess the legal transfer mechanism, risks, safeguards and remedies