Classification of personally identifiable information. An indication that the information MUST be classified at least as C2 also is, if the following consequence could arise for the relevant individual in case his or her personally identifiable information would become public or would be leaked to an unauthorized party: impact on privacy is small or moderate. In alignment with the MunichRe Group definition, the term “impact on privacy” means: Physical, material or non-material damage to natural persons, such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorized reversal of pseudonymization, damage to reputation, loss of confidentiality of personal data protected by professional secrecy, or any other significant economic or social disadvantage to the natural person.
Classification of personally identifiable information. An indication that the information MUST be classified as C3 also is, if any of the following consequences could arise for the relevant individual in case his or her personally identifiable information would become public or would be leaked to an unauthorized party: • impact on privacy is significant or even serious, • personal loss or significant restriction of freedom of will and action.