This reads like you are intentionally trying to misunderstand. GDPR has two categories of user information: direct identifiers and indirect identifiers.

Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort.

Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted:

- The tuple (bank account number, country) is enough to target an individual.

- The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß]

Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect.

Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers.

ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.