GDPR defines "personal data" as any information relating to an identified or identifiable natural person.

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

By that definition, it sounds like anything a user writes on a website that requires registration (even if with only an email and a password) is to be considered personal data, even if that data is meant to be public like in the case of internet forum posts, even if the post content is just a simple opinion, thought, or story. Is this correct? Or are there any specific cases where forum posts might not be treated as personal data?


In the general case, it seems unlikely, based on the wording (which is convoluted). In certain cases, if the president of Russia posts "My name is Vladimir Putin", that post is personal data. On the other hand, you might, based on my writing, conclude that I am from the US, and you might even conclude that I'm in Washington state, but that doesn't distinguish me from 7.5 million others, so on those grounds that is not personal data. Eventually, though, you might identify me specifically from other things that I may have said on SE.

The definition depends on two parts. First, personal data is "information relating to an identified or identifiable natural person". Any "information" provided by a natural person is "related to" that person (as is any "information" that is about such a person). The second part defines "identifiable natural person", that is, who is an "identifiable person"? Every person can, in principle, be identified by reference to some label or description of fact about them, so every person is an identifiable person, under this definition. This means that every piece of text that refers to an individual (not even text which can identify the person) is "personal data". Obviously, any individual can be uniquely identified by some collection of identifiers; the problem is that the wording of the law does not explicitly say "using that supposed personal data". If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is.

Another term that the regulation defines and uses in a few places is "pseudonymization", which is defined as

the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person

The point of interest here is that this says that "personal data" which cannot be attributed to an individual is, nevertheless, still personal data. I think the most important part of the regulation is art. 6, which defines lawfulness of processing, especially para 4., which allows consideration to be given to safeguards such as pseudonymization.

  • If this is the case then the law is poorly worded. They could have said that personal data is any information that can be used to identify a person, directly or indirectly. By saying "any info relating to" it sounds like it's actually any info provided by the user, even if just a joke posted on a forum, giving the user full control over whatever they write online (like withdraw consent and delete the data). In any case, I'm afraid that posts about certain subjects (politics, health, etc.) are likely to be seen as sensitive data.
    – reed
    May 7 '18 at 20:08
  • 2
    Apparently it has already been decided that an IP address is personal data, I suppose because it is "information relating to ... an identifiable natural person." I do not know the details, however. But if we accept that proposition then it is hard to see how data posted from an IP address would not also be personal data unless the IP address were removed. Also, the question assumes that the data has been posted through an registered user profile.
    – phoog
    May 7 '18 at 21:47
  • 4
    Furthermore I don't think it is an oversight that the regulation does not explicitly say "using that data" because part of its purpose is to protect people from invasions of their privacy; there can be private information that does not help identify someone.
    – phoog
    May 7 '18 at 21:50
  • "If I mention that I have a relative named Knudt, that would technically be personal data: I've given information that relates to a person, though you have no idea (and could not possibly figure out) who that person is." - If you can't figure out who the person is from the data, it isn't personal data within the definition in the GDPR.
    – Lag
    Jun 5 '18 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.