would this data be subject to GDPR regulations? it's not PII (at least as our company is defining it - i guess that might be a point of contention)