[laurentl]

It counts as personal data, and as such, under the GDPR you have a duty to handle that data sensibly and responsibly.