gdpr
Are artificially generated personal data covered by the GDPR?
<p>According to Article 2(1) GDPR:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, <strong>an identification number</strong>, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</blockquote>

<p>In my country, Poland, we have a national identification number called <a href="https://en.wikipedia.org/wiki/PESEL" rel="nofollow noreferrer">PESEL</a>. It has 11 digits which encode date of birth, sex, ordinal number and one checksum digit. All combinations can be easily generated on todays computers.</p>

<p>Article 87 GDPR states that:</p>

<blockquote>
  <p>Member States may further determine the specific conditions for the processing of a <strong>national identification number</strong> or any other identifier of general application. In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation.</p>
</blockquote>

<p>if I generate all 1,826,210,000 PESEL number combinations, do I become the holder of the personal database of all Polish people and (if I am a company) do the obligations arising from the GDPR begin to apply to me?</p>

<p>Generating a list of all possible numbers doesn't sound like it would constitute personal data any more than listing all dates for the last hundred years as a "possible date of birth" would.</p>

<p>However, the moment anyone linked even one of the numbers with any other personal data - for example a name - they would be bound by GDPR and would need to show a Lawful Basis for processing the data.</p>

<p>[If you linked your own name you could presumably argue Consent, but anyone else's would need to have an associated Lawful Basis.]</p>
