When is Personal Data NOT in the Scope of the GDPR?