Both times: yes and no. They both are indeed considered personal data, but they don't always have to be disclosed (as disclosing might harm others)