First topic, what constitutes personal data?
In the US, when we hear "personal data," that usually equates to Personally Identifiable Information (PII). PII, according to the CIO of the US Navy, is "information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother's maiden name, biometric records, including any other personal information which is linked or linkable to a specified individual." This has become an important enough topic that NIST has created a list of specific fields that constitute PII.
How does this differ from how personal data is defined in GDPR?
Well, according to the GDPR, personal data means "any information relating to an identified or identifiable natural person."
Side note: In GDPR, "natural persons" are typically referred to as, "data subjects," which is the least personal and least natural possible way to describe natural persons that I can think of, but I digress...
GDPR clarifies that "identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."
In other words, personal information includes the US definition of PII, but goes much further. In addition to PII, personal information can include IP address (yes, even dynamic IPs with user behind a router doing NAT/PAT), sexual preference, medical prescriptions, occupation, eye color, shoe size and puzzling fandom of the band Survivor.
That's lesson #1 - personal data, as defined by GDPR, goes far further than the typical US definition of PII.
More to come in future posts...