EMail Addresses are protected by the GDPR. Passwords are too.

THat doesn't mean you can't use email addresses without asking; ie if the comment system uses emails to notify people of replies or moderative actions, then it's totally legit to collect it for exactly this purpose.

You only need consent if the personal data collected isn't strictly necessary for the operation of your site, ie if you use tracking cookies and sell emails to advertisers.

> For example, do email addresses on the comments on a blog site fall under that protection?

That is not unclear at all. They absolutely do.

That doesn't mean you can't have them, but it means you need consent, you need to be clear about how you will use them and you need to let people withdraw consent.

You can't win an argument about whether something is unclear by proving (let alone merely asserting) it is so. This is something a lot of people seem unclear on.

The only people unclear on this point are people who have failed to do even the most basic research into what GDPR says. It is blindingly obvious that an email is information that can be used to identify a person.

I'm not arguing with you. If it is clear, then it suggests people saying it is not clear are basically trolls. Surely you can see that telling an apparent troll to admit being a troll is unproductive. You might be right, or you might be wrong, but you can't win that debate because it's about inner motivations and perceptions and not verifiable facts.

Whether something is clear or not is not dependent on whether a specific person knows it.

A reasonable person who is even minimally informed about GDPR will know that an email address is covered by GDPR, hence it is "clear".

Why though? Email addresses are quite obviously "something that identifies a person".

I'm not debating what's clear or not to me. My point is that it's subjective and if someone says a thing is unclear, you can not necessarily make it clear to them or force them to admit they are lying about their perception. Arguing with confusion is like debating whether someone is in pain when they act like they are. It could be they are lying. It could be they are not. It could be they are particularly stupid.

I want to emphasize - you can be right or wrong about the GDPR, but that's not the same thing as being right or wrong about whether people are confused by it.

I think it should be obvious that debating feelings or perceptions or emotions of other people tends to lead to unproductive interpersonal interactions, but perhaps others have not noticed this phenomenon. I can't imagine winning a debate with someone over whether they are trolling or not. Even if it's really obvious, nobody can see inner motivations for sure.

> It could be they are lying. It could be they are not. It could be they are particularly stupid.

At the point where one can prove that one part is too (trollish || stupid) I think it is reasonable to limit how much we care about their opinions.

You seem to be making the same mistake a lot of people (especially those from countries with no regard for consumer protection or privacy) do with regard to the GDPR:

It's not about e-mail addresses. It's about personal information. It's not about what data you can have. It's about how you can use data.

You don't own my personal information, I do. If I give my information to you, you can only use it in whichever ways I consented to when I gave it to you. If you want to use it for something else, you need to ask me again. And you can't just give me a blanket CYA contract to sign just so you can decide later.

This is precisely how it would work in normal everyday social interactions. If I go to a Mom & Pop shop and give them my number so they can call me when my favorite brand of soup is back in stock that doesn't mean they can call me to tell me about random new stuff they carry or give my number away to someone else.

Personal information is owned by the person it is about. It gets murky with aggregates (but the GDPR helps you figure out which ones are still considered personally identifiable) but it's blindingly obvious for things like "enter your e-mail address".

Do you have an e-mail input in a contact form? I'm going to assume that'll be used so you can respond to me although it'd nice of you if you say that explicitly right there on the form. If it's a comment form, why do you need my address? Who will it be shown to? What are you going to do with it? Where will it be stored and how can I tell you to delete it later? That's why you now need to think up a Privacy Policy: these are questions you always had to answer for yourself but now you're legally required to make conscious decisions about this.

Is this too much of a hassle? That likely means you didn't have any good reason to collect that information in the first place. Great! Personal information is a liability and it's better to collect less of it than more. Although that may disappoint future Zuckerbergs, collecting people's private information (even if they give it away voluntarily) imbues a lot of responsibility on you if you don't want to be completely careless. And the GDPR is an example for a policy that gives that responsibility teeth and punishes companies who are careless.

You don't want to store passwords in plaintext. You don't want to hoard credit card details or medical data. Personally identifiable information is no different. The GDPR just provides ways for you to store and use that information legally, in addition to reiterating that privacy and control of your personal information is a human right.