If someone enters personal data in a field which purpose is not to handle personal data, does GDPR apply?
For example if someone enters their email, phone number or name in a password-field? If so, does it matter if the password is salted and hashed, only hashed, encrypted or plain text?
Or let's say they enter their name, adress, phone number, email, social security number and exact GPS-coordinates in a field used for registering some kind of "random" alphanumeric promo code. The promo code is logged and/or stored in plain text on a server when they press "Apply". Does GDPR apply in this case?
It can't be expected that someone will enter personal data in these cases. But where exactly does one draw that line? Does the field need to be clearly marked "Email", "Phone number", etc. in order for GDPR to apply? If so, what about a field marked "Username" - a username alone isn't necessarily enough to identify a physical person?