[scaryclam]

IIF they are processing personally identifying information.

[M2Ys4U]

Personal data, not personally identifying information.

The former is a lot broader then the latter (and the latter is a US legal term and means precisely nothing in the EU).