A parks department spreadsheet of season-pass holders is called “just names” and therefore “not personal data.” Which GDPR assessment is correct?
Select an answer to reveal the explanation.
Short Explanation
If you can point to a real human behind the row—hello, season-pass holders—“just names” is still personal data. GDPR cares about identified or identifiable people, not whether the file looks fancy. Calling it a boring spreadsheet does not make the people disappear.
Full Explanation
Information relating to an identified or identifiable natural person—such as season-pass holder names—is personal data under the GDPR. A parks department spreadsheet of “just names” is not outside the definition merely because staff find the fields ordinary. Names of natural persons are not excluded unless a national ID is also stored. Ordinary names are not outside GDPR because they are not encrypted biometric templates. Spreadsheets maintained by public bodies are not categorically exempt from the personal-data definition. Article 4(1) is medium- and sector-neutral: identifying names in civic recreation systems remain personal data. Exam caveat: “too ordinary to be personal data” distractors fail Article 4(1). Operational check: inventory parks CRM and spreadsheet exports; label name and contact fields as personal data; assign a lawful basis and retention schedule before any open-data publication review. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.