>only when it can be identified.

Note that it also includes indirect identification, which means that if combined with other data it would identify you. Recital 30 might be of use here too;

>Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

My HN username (Rygian) is PII because it can be used to identify me indirectly (HN has a log of my username connecting from IP x.y.z.w, and my IP address is PII).

In the US there is precedent (existing court rulings) against IP address being PII. Obviously, IP address is not very good PII, and never guaranteed to be able to identify someone.

Whether HN has a log of it is an assumption I don’t have a way to verify. Lots of privacy-conscious sites purge connection logs often and/or refuse to keep them for this very reason.

IP addresses are PII in Europe.

This may sound pedantic but PII is not even mentioned in the GDPR. It's a notion from U.S. law.

The GDPR refers to "personal data". Everything you say above about PII is true of personal data under GDPR.

Most people have an email address on their profile, that's PII. One could post one's name, that's definitely PII and AIUI that affects all the data then on the site, as it's now associated.

Are you sure forum comments can count as PII, according to GDPR definitions?

Article 4(1) of the GDPR states the relevant definition: "Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person".

That should be read in light of the recitals, for instance recital 26:

"The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes."

From these I think it should be obvious that forum comments may be (and even probably are) considered to be personal data under the GDPR.

It’s also obvious that many comments might not be PII too, right? Whether they are depends entirely on whether the user has chosen to share PII, but in any case it’s not automatic, it’s not structured data that’s easily searchable in general, and typically depends on whether other identifying information is available. In other words HN doesn’t ask for PII, has no way to know what comments are PII in general, has no way to reliably identify EU citizens, does not operate in the EU or target EU citizens, has no structured way to profile EU citizens. I’m wildly in favor of online data protections, and I think the GDPR has done many good things, but this particular example does not seem to constitute a clear example of either GDPR applicability nor (tangentially & IMO) of need for data control.

>GDPR is an EU law that applies to sites that market directly to EU citizens.

That is wrong. The GDPR does not make reference to citizenship.

It explicitly notes that it applies when either when the data subject is physically in the EU/EEA, or when the data controller/processor is based in the EU/EEA.

You’re right, I described it incorrectly. GDPR applies to “subjects (natural persons) within the Union”. As an example, EU citizens living abroad are not covered by GDPR. Americans visiting HN from the Bay Area also shouldn’t expect to have the rights that GDPR grants to subjects within the Union, right?