I am literally face palming so hard right now. I also wish I'd seen this reply earlier.

The GDPR never mentions "personally identifiable data" as that is a US term. In the GDPR, it only says "personal data" which is the exact same thing according to the GDPR.