From GDPR Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natu

From GDPR Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; To layer on some interpretation: * Red Shell is collecting information * which relates to "an identifiable natural person" * who "can be identified [...] by reference to [...] one or more factors specific to the physical [...] identity of that natural person" * where these factors are the information Red Shell is collecting about the software and hardware of their physical devices * and thus are "personal data", as regulated by the GDPR. Given that their primary purpose is identifying users, they're going to have a hard time arguing that they don't fall under the GDPR's jurisdiction.