IANAL, but I do work for a UK based company ultimately owned in the Republic of Ireland. We handle millions of records of personal information and substantial card transactions on behalf of clients. My employer is, quite rightly, ***** scared of falling foul of the law relating to GDPR and the somewhat similar (and arguably even more draconian) PCI DSS (payment card industry data security standards) as, ultimately, the company could effectively be closed without so much as a court case. So we all get regularly trained and retrained in what it all means. IMO an "id number", in and of itself, is not PII. However as soon as you (or a third party) can tie up that "id number" with who or where you are or anything personal to you, then you are on dodgy ground assuming said "id number" is not personal. IP addresses very much come in that category. One might think that "where you are" isn't all that personal as hundreds or thousands or more may live in your town, but add in a slightly unusual surname for example and suddenly you can be identified in detail by someone determined to find out. It isn't that you can't store such data, it is that you have to be able to demonstrate a need to do so and that you delete it when it is no longer needed and that your networks and databases are secure and so on. In other words you have shifted heaven and earth to make sure things are as safe as they can be. Nick