What would constitute personal data?
<p>For example, would a name in the form first initial last name be considered personal data, considering this could apply to many people?</p>
<p>What about if we added in a hobby, perhaps that they watch football or like GTA. Would this make this personal data or would it still be generic enough to not be?</p>
<p>For example, a document with a list of 25 names was held for the purposes of a roster with no further information, or was titled by 'Man City fans' or 'GTA players' with no further information.</p>
<p>Source:</p>
<blockquote>
<p>By itself, the name ‘John Smith’ may not always be personal data because there are many individuals with that name. However, if the name is combined with other information (such as an address, a place of work, or a telephone number) this is often sufficient to clearly identify one individual. [ICO]</p>
</blockquote>

<blockquote>
<p>For example, would a name in the form first initial last name be considered personal data, considering this could apply to many people?</p>
</blockquote>
<p>Yes, it is. Your IP address could be used by a whole campus, there could be dozens of people living in your appartment block, many, many people could be called John R. Doe, it does not change the fact that it is personal data.</p>
<blockquote>
<p>What about if we added in a hobby, perhaps that they watch football or like GTA. Would this make this personal data or would it still be generic enough to not be?</p>
</blockquote>
<p>That is still personal data. You could argue that it does not fall under the GDPR, since it is &quot;personal or family&quot; use. You are not a company, these are your 12 buddies. Whether that is true or not, is something only you can decide.</p>
<blockquote>
<p>For example, a document with a list of 25 names was held for the purposes of a roster with no further information, or was titled by 'Man City fans' or 'GTA players' with no further information.</p>
</blockquote>
<p>Yes, this is personal data. But whether the GDPR applies to it depends heavily on what you do with it and who those people are. Are you a company that holds them in a computer system for their online fantasy football game? The GDPR applies. Are you a guy on his couch who scribbled their friends names on a piece of paper for your personal fantasy football league? The GDPR does not apply. Somewhere in between? Maybe you need a real lawyer to figure out the exact borders you should not cross.</p>

<p>The GDPR defines personal data in Art 4(1) to mean</p>
<blockquote>
<p>any information relating to an identified or identifiable natural person (‘data subject’)</p>
</blockquote>
<p>There are two criteria here:</p>
<ul>
<li>the information must <strong>relate</strong> to the data subject</li>
<li>the data subject must be <strong>identifiable</strong></li>
</ul>
<p>Notably, it does not require that the data subject is identifiable <em>through</em> that information. What counts as identifiable is explained in the remainder of that paragraph, and in GDPR Recital 26. In particular, the data subject is still identifiable if you can only do so if you combine the information with additional data, or if you can only do so with assistance from third parties. Identification can also be indirect, for example by “one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity” which could include hobbies or video game preferences.</p>
<p>What counts is whether you have the reasonable means to likely identify the data subject, if you tried.</p>
<p>Thus, the GDPR concept of personal data includes information that can be linked to a person, even if the information itself is not identifying.</p>
<p>Whether your examples of information qualify as personal data will depend a lot on the context. While you might not be able to identify the data subjects yourself, you might know someone who can do that. A list of names is likely to be directly identifying though, and would then inherently be personal data (unless you knew e.g. that the names only referred to deceased or fictional persons).</p>

gdpr