GDPR - Are the typical lists of examples for personal data misleading?

Question

Article 4 of the EU GDPR states

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);

The explanation for the term ‘personal data’ as

Personal data is any information that relates to an identified or identifiable living individual.

on this webpage of the European Commission (EC) is inline with the definition in the law. The text on this page goes on and describes this in more depth. The pages contains also a list of examples for personal data:

a name and surname;
a home address;
an email address such as [email protected];
an identification card number;
location data (for example the location data function on a mobile phone)*;
an Internet Protocol (IP) address;
a cookie ID*;
the advertising identifier of your phone;
data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.

Since it is the example list by the European Commission, many webpages which give examples for personal data in the sense of the GDPR have very similar lists.

However, compared to the definition of personal data this list of examples seems to be misleading. In my understanding of the GDPR personal data are all data related to a identified or identifiable person. So, I would additionally give the following two examples in order to show how far this can reach:

• Chat messages stored together with the user's name in a data base would be personal data.
• All the email messages in the inbox of a natural person would also be personal data, because all these messages are related to a natural person by the recipient's email address. (I assumed that the email address identifies the person, which should be usually the case. Otherwise, the contents of messages might make the person behind the email address identifiable.)

I would say that my understanding is in accordance with some answers on Law SE, see, e.g., here.

With this in mind the list of examples on the EC webpage looks to me more like a list of data which identify a natural person. Thereby, these data are personal data. But personal data are much more, all data related to "identified or identifiable natural person". In this sense this list of examples appears strange and misleading to me.

Do you also think that this list of examples is misleading?

Answer 1

Indeed, the examples given by the European Commission all involve directly identifying data. It seems that the lists of examples should not be considered exhaustive or authoritative, but that they should be considered as examples of “definitely personal data” and “definitely not personal data”, thus painting a bright line between the two.

Other kinds of personal data are much more context dependent. Indirectly identifying information is only identifying in combination with other data. Some data might not be personal data at all until it is linked with identifiers so that the data relates to an identifiable person. To determine whether such information is personal depends entirely on how is is processed.

For example, an email message is not automatically personal data. If I in the role of an employee write a business email, the email contents will likely relate to the business matter and not to me as an individual, even though I'm identifiable via the email address. However, the email contents might start to relate to me if it is used e.g. to review my performance or conduct.

So while I generally agree with your examples, I think it would be out of scope for such a general web page to dive so deeply into the nuances of what is an isn't personal. Such discussion would likely end up being more confusing than helpful. And in cases where it isn't quite obvious whether the definition of personal data applies – as in my above example, which is merely my opinion and not any official guidance^[1] – it is not up to the EC but up to the courts to determine whether this definition applies.

---

[1]: While this example was closely based on ICO guidance on the “relating to” criterion which seems well-reasoned to me, it has no bearing on other data protection authorities and Brexit has rendered it irrelevant in an EU context.