GDPR: Is only a birthday personal identifiable information?

Question

I wonder if only a birthday is seen as personal identifiable information according to the GDPR, so no usernames, passwords, emails, phone numbers are present in the system. Literally only a birthdate. And if someone can answer this it would be great if you could link the source as well since I can't seem to find this.

Answer 1

This depends on the context – GDPR rarely restricts the use of specific kinds of data (see Art 9) but instead regulates the processing of this data, and the purposes for which it is processed.

Personal data is any information relating to an identifiable person (Art 4(1)). So to show that some information is not personal data, you must show either that it doesn't relate to the identifiable person, or that it's not possible to identify the person.

Whether a person is identifiable depends on the means of identification that are reasonably likely to be used, taking into account the cost and effort of these means (Recital 26). This recital also mentions that singling out a person is a kind of identification.

If you have lots of birthdays so that there are no unique birthdays, or if the birthdays are stored without contextual information that would allow identification, this can indicate that it's not personal data. Some examples to illustrate my views:

• Scenario 1: you are collecting statistical data in a shopping mall and are collecting birthdays from passer-bys, without any additional information. This information is anonymous and not personal data, since you have no reasonable means to identify the persons.

• Scenario 2: in an office, there's a publicly visible calendar on the wall with the birthdays of all staff members. However, the calendar doesn't say whose birthday it is. This information is likely personal data, since it's reasonably possible to infer the correct person based on contextual information. At least HR would also have the birthday for all staff members on file, so that the company clearly has the means to identify anyone. (This doesn't mean such a public calendar is illegal, just that there must be a legal basis.)

It is more difficult to determine whether information also relates to an identifiable person, i.e. whether this information is about that person. This depends not just on what the information is, but how the information is used. AFAIK there has yet to be EU-wide guidance by the EDBP, but the ICO has listed some hints. I think that a birthday of an identifiable person will almost always relate to that person.

Answer 2

Is only a birthday personal identifiable information?

It depends, as pointed out by Greendrake. See the definition of "personal data", article 4(1) of the GDPR. I will assume that the scope of your question is not restricted to a small population, and from there you can contrast it with any unspecified particularities you might have in mind.

There are thousands (perhaps millions) of births every day where the GDPR applies. This implies that many, many people have the same birthdate (and even more people have the same birthday). Therefore, a birthdate is useless for identifying a natural person.

Furthermore, neither birthdate nor birthday fits, or gets close to, any of the categories of identifiers listed in article 4(1) and other reasonable alternatives. Although birthdate determines a person's age, the latter is not a factor "specific to the physical, physiological, [... or] mental, [...] of that natural person" because people's aging and said factors depend on the person's lifestyle, life events, and other factors which are not captured in the person's age or birthdate.