There's a difference between "is able to" and "does".
“However, if that company is able to combine that information with other information about that individual [...] this could constitute personal data. The company would then need to notify customers about the way in which and the purposes for which their personal data is being processed,"
There's a big difference between "is able to" and "does". If you insist on the "is able to" test, then you'll simply have a lot of organisations forced to tell punters "We collect X but do not combine it with any other data afterwards so it doesn't matter." (or words to that effect). The end result would be a general public that routinely ignores "data protection" notices.
If you are wandering about in public, people can see you. If they want to track you, they can. We've come several thousand years without society reckoning this is a problem. If it is just a shopping mall trying to improve its floor plan, only the irredeemably anal will care. Obviously if they then hand over the data to the local anti-terror spooks we might have a problem with that, but let's keep our "public outrage powder" dry for that moment when it comes.