Does the mere fact that data relates to a subject mean that the data is protected by the GDPR?

Question

Suppose I check into a German hotel and a Johann stayed in room 123 on the previous night.

Presumably, he is the only Johann who stayed in the room on that night.

There are many Johanns within Germany who could have stayed there, and I’d have to go looking (this could be easy or difficult) for the one that did if I were so inclined to find out more about this mysterious guest.

For example, I can’t market to this Johann without doing more investigation.

If the hotel were to tel me “there was a Johann who stayed at room 123 last night,” have they violated GDPR merely by divulging information that pertains to one person?

Answer 1

It's personal data, but GDPR might not apply in that scenario.

The GDPR has a very broad view of “personal data” – this term describes any information that relates to an identifiable person, even if you can only identify them indirectly, by using additional data, or with the help of third parties. For determining whether someone is identifiable, we have to consider all the means that you could reasonably likely use. Even being able to single out on person's records in a larger data set counts as identification.

So yes, this information about “Johann” is probably personal data within the meaning defined by the GDPR. There are reasonable scenarios in which you would have the means to likely identify them more directly, for example with the help of the hotel or with the police.

But just because something is personal data doesn't mean that the GDPR swoops right in and makes everything illegal. Instead, consider that the GDPR regulates certain processing activities. Per Art 2(1):

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

So for the GDPR to apply, the relevant processing activities need to involve electronic means or a filing system. This is in practice not a big constraint on the GDPR's scope, because nowadays nearly everything involves electronic means, like smartphones, apps, websites, or computers.

To determine whether the hotel breached GDPR by letting you know that the previous guest was named “Johann”, we have to consider how they did it.

• During smalltalk with the concierge, the previous guest's name is dropped. Since this personal data was retrieved from the concierge's memory and not from an electronic or filing system, this act was out of scope for the GDPR. It's still a gross breach of the confidentiality expected from hotels, but it's not a GDPR issue.

• Hotel staff looks up the previous guest's name in their records. Since processing involving these records is subject to GDPR, the hotel would need a clear purpose and legal basis for divulging information from these records to you. So this would probably be a GDPR violation, unless there's some legitimate interest involved here.

As a somewhat related incident consider the EUR 35M fine against the clothing retailer H&M. It is normal for managers and employees to chat about their holidays, and sometimes about personal lives. That is not covered by the GDPR. It is not normal for these manager to maintain detailed records about the employee's personal lives, health status, religious beliefs, and personal problems. Such records would fall within scope of the GDPR and can only be created/used when there's a clear purpose and legal basis.

Answer 2

Yes

The person who stayed in a particular room on a particular night (even if you don’t know their name is Johann or anything else about them). Under the GDPR PII or Personal Identifiable Information is any data that can be used to clearly identify an individual. There was only one (or a small number) of people who stayed in the room so the mere fact the room was occupied is PII.