The case highlights the broad scope of ‘personal data’ under the data protection laws. The obligations and duties on data controllers and processors, depending on the facts, may well extend to other identifiable individuals when processing the personal data of data subjects if they can be identified.