> This isn’t true. This is a common misconception. GDPR strictly defines personal data into a narrow band of attributes. Generally any content that you make pub

> This isn’t true. This is a common misconception. GDPR strictly defines personal data into a narrow band of attributes. Generally any content that you make public that doesn’t identify a natural person or is sensitive by some other definition is not personal data. No, this isn't correct. I've spent too many hours in calls with lawyers (from the EC) regarding this. You quoted the exact line that makes it difficult: > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR. This is applied very strictly. If you have a datum that can be used to identify a specific person out of *any* arbitrary set of people then that datum is personal information. Remember the COVID apps which worked using pseudorandom numbers shared by bluetooth? Those numbers are personal information despite the technical implementation being required to link person to ID being very hard. Same thing for the SHA2 of a COVID certificate (just the hash, no other information over the holder). Not all regulators apply the laws the same / correctly and commercial companies who have an army of lawyers ride roughneck over the laws because they have bigger pockets than any regulator.