In the GDPR regulations, personal data is defined as «any information about an identified or identifiable natural person.» That’s pretty comprehensive. Just think about what we as employers surround ourselves with when it comes to information about our employees.
It makes sense that we are asked to control data about our employees, at least when we think about data such as salary information, personal information, social security numbers, next of kin and our employment contracts. And it also makes sense that we place restrictions on who should have access to this.
But what about less «dangerous» information like my phone number, what position I hold, what I’m good at, what I’m responsible for, or when I’m available for a meeting? By definition, this is also personal data, but do we need to restrict access to this information?
This is one of the reasons why we should consider the risk associated with data being compromised. There is quite a big difference between my phone number and my social security number being compromised. In addition, there is a quite different need in the organization to make my phone number known, rather than my social security number.
In most organizations, a prerequisite for working together effectively is that we have access to each other, that we know who is responsible for what, who is a specialist in what, etc. This is information that carries a low risk of misuse, while at the same time it is absolutely necessary to share such information for effective internal interaction.
In order for us to be able to handle this in an appropriate way, we should create a description of what we can then call open personal data; what this is and what it means that it is open. The description has several purposes. It should provide a legitimate justification for why the information must be shared internally, it should describe what information is involved and, not least, it should explain to employees that when you are employed here, you must allow such information about you to be open to other employees.
For the vast majority of people, this is not a problem; on the contrary, it is relatively obvious that this is how it must be. We just have to ensure that this also happens within the regulations by documenting it.
