The GDPR works on the personally-identifiable vs anonymous distinction. Private vs public doesn't really factor into it, or at least only becomes relevant in the nuances.

Personally identifiable data is just a mouthful, which is why people like to misleadingly shorten it to private data.