Data practice questions.

In 2006 a search company released twenty million search queries for research, with each user's name replaced by a number. Within days journalists had identified an individual user from the content of her own searches. What does the episode establish?

• That the release was unlawful under data protection rules in force in the United States at the time
• That search queries are of no research value once the identifying columns have been removed from them
• That the numbers used to replace the names had been generated in a way that could be reversed
• That the records themselves can identify a person once enough of them belong to the same individual

Answer: That the records themselves can identify a person once enough of them belong to the same individual

Identification came from the pattern of one person's own searches, so no key had to be broken and no column had to be re-attached: the data were the identifier. This is why 'we removed the names' is not a claim about anonymity but a claim about one field.

A transport authority wants to publish, as open data, every tap-in and tap-out on its network with the exact time and station. A researcher points out that a regular commuter's pattern is close to unique. What is the appropriate response?

• Publish the records unchanged, because a card number is not a name and the file therefore holds no personal data
• Publish counts by station and time band instead, because the detail that identifies a commuter is not needed for the stated purpose
• Publish the records only to researchers who ask, because a request form removes the risk of identification
• Publish the records with the station names replaced by codes, because the codes cannot be matched to real places

Answer: Publish counts by station and time band instead, because the detail that identifies a commuter is not needed for the stated purpose

The test is whether an individual can be singled out, not whether a name appears, and journey patterns single people out reliably. Aggregation to the level the purpose actually requires is the standard remedy, and it keeps the dataset useful for planning.

A company established only in Argentina runs a Spanish-language shopping site. It ships only within Argentina, prices only in pesos and does not monitor visitors from other countries. A resident of Spain finds the site while travelling in Argentina and opens an account. Which statement about the territorial reach of the GDPR is correct?

• The GDPR applies, because protection under the Regulation follows the nationality of the person concerned.
• The GDPR applies, because any site that can be opened from inside the EU falls within its scope.
• The GDPR does not apply: the company neither targets people in the EU nor monitors them.
• The GDPR applies, because personal data about a resident of Spain are being processed at all.

Answer: The GDPR does not apply: the company neither targets people in the EU nor monitors them.

Article 3 of the GDPR ties its reach to establishment in the EU, to offering goods or services to people who are in the EU, or to monitoring their behaviour there — never to citizenship. A service outside that reach is not unregulated but regulated elsewhere: Brazil's LGPD has applied since 2020 and Kenya's Data Protection Act dates from 2019.

A city council reports that 'residents are satisfied with the new parking app', citing 4 200 replies to a questionnaire that appeared inside the app when it was opened. What is the strongest objection to the conclusion as stated?

• Only people who installed and opened the app could answer, so it excludes those it failed.
• Four thousand two hundred replies is too small a sample to describe a city of this size.
• The council should have reported the result as an average score rather than a proportion.
• Satisfaction was measured at a single moment instead of being tracked over several months.

Answer: Only people who installed and opened the app could answer, so it excludes those it failed.

The fault is the sampling frame, not the sample size: residents who never installed the app, or deleted it in frustration, cannot appear in the data at all, so the survey reports only on the people the app already kept. Ten times as many replies gathered the same way would repeat the same exclusion.

A city puts a PDF of last year's road-accident locations on its website. The file is free to download and no account is needed, but it carries no licence statement. A researcher asks whether this counts as open data. Which single check settles the question?

• Whether the file can be downloaded without creating an account or paying a fee.
• Whether a licence grants anyone permission to reuse and redistribute the contents.
• Whether the data were collected by a public body rather than a private contractor.
• Whether the file appears in search engine results and is therefore easy to find.

Answer: Whether a licence grants anyone permission to reuse and redistribute the contents.

Open data is defined by the permission attached to it, not by the price or the ease of access: without a licence permitting reuse and redistribution, a downloadable file is merely public. A PDF also falls short of the machine-readability expectation, but it is the licence that decides the category.

A charity's online donation form ends with a box, ticked by default, reading 'keep me informed about our work by email'. Most donors leave it as it is and the mailing list grows quickly. Under the GDPR, which single change to the form would make the consent valid?

• Adding a link to the full privacy notice immediately beneath the box.
• Adding an unsubscribe link to the bottom of every email that is sent.
• Moving the box above the donation amount so that donors see it sooner.
• Leaving the box unticked, so that consent requires a deliberate action.

Answer: Leaving the box unticked, so that consent requires a deliberate action.

Consent under the GDPR must be an unambiguous indication given by a statement or a clear affirmative action, and in Planet49 (2019) the Court of Justice of the EU held that a pre-ticked box does not meet that test. A better notice or an easier unsubscribe does not repair a consent that was never actively given.