Anatomy of personal information processing: application to the EU privacy directive

The term 'processing' (in relation to personal data) and its derivatives occur 213 times in the EU Privacy Directive. Yet the directive defines it in imprecise language. This paper investigates the notion of Personal Information (PI) processing in terms of a flow model with four phases and 17 generic acts on PI. This provides fine-grained sub-processes of PI processing and the opportunity to tailor privacy codes according to the requirements of each sub-process. The methodology is applied to the EU Privacy Directive of 1995.

Keywords: privacy, personal information processing, EU Data Privacy Directive, European Directive, information security, privacy protection, personal data