Are a first and last name or an email address without any additional information personal data?
ANSWER
The definition of personal data in Article 4(1) GDPR, according to which 'personal data means any information relating to an identified or identifiable natural person', does not allow us to state that specific information will always or never be personal data. As explained in the definition, an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Answering the question: if on the basis of a first and last name or an email address it is possible to identify a specific person, then they are personal data. A first and last name on its own, without being linked to other data, will in most cases not yet constitute personal data. For example, if there are a hundred Jan Kowalskis in Warsaw, such a name alone is not personal data — additional data is needed to identify a specific Jan Kowalski, e.g. their telephone number or the name of the company they work for. However, some first and last names may be unusual enough that the probability of identification is very high.
As a rule, email addresses are personal data, because when writing to a given address we usually write to a specific person and thereby identify them. There may, however, be email addresses that do not constitute personal data, e.g. [email protected], because we are writing to a company and not to a specific individual.
In accordance with Recital 26 GDPR, 'to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used (…) such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments'.
