A parks department spreadsheet of season-pass holders is called “just names” and therefore “not personal data.” Which GDPR assessment is correct?
Select an answer to reveal the explanation.
Short Explanation
If you can point to a real human behind the row—hello, season-pass holders—“just names” is still personal data. GDPR cares about identified or identifiable people, not whether the file looks fancy. Calling it a boring spreadsheet does not make the people disappear.
Full Explanation
Article 4(1) GDPR defines personal data as any information relating to an identified or identifiable natural person. Names in a parks season-pass list ordinarily identify natural persons and therefore constitute personal data. Neither the absence of a national ID, the non-biometric nature of the field, nor the public-body context removes ordinary identifying names from that definition.