Article 4 of the EU GDPR states
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’);
The explanation for the term ‘personal data’ as
Personal data is any information that relates to an identified or identifiable living individual.
on this webpage of the European Commission (EC) is inline with the definition in the law. The text on this page goes on and describes this in more depth. The pages contains also a list of examples for personal data:
a name and surname;
a home address;
an email address such as firstname.lastname@example.org;
an identification card number;
location data (for example the location data function on a mobile phone)*;
an Internet Protocol (IP) address;
a cookie ID*;
the advertising identifier of your phone;
data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.
Since it is the example list by the European Commission, many webpages which give examples for personal data in the sense of the GDPR have very similar lists.
However, compared to the definition of personal data this list of examples seems to be misleading. In my understanding of the GDPR personal data are all data related to a identified or identifiable person. So, I would additionally give the following two examples in order to show how far this can reach:
- Chat messages stored together with the user's name in a data base would be personal data.
- All the email messages in the inbox of a natural person would also be personal data, because all these messages are related to a natural person by the recipient's email address. (I assumed that the email address identifies the person, which should be usually the case. Otherwise, the contents of messages might make the person behind the email address identifiable.)
I would say that my understanding is in accordance with some answers on Law SE, see, e.g., here.
With this in mind the list of examples on the EC webpage looks to me more like a list of data which identify a natural person. Thereby, these data are personal data. But personal data are much more, all data related to "identified or identifiable natural person". In this sense this list of examples appears strange and misleading to me.
Do you also think that this list of examples is misleading?