thanks for clearing that up. you were unclear that you were speaing in terms of utility rather than legality. legally you "can't" and "may not". To do so would be in breach of the law.
GDPR has expectations that Data Controllers take reasonable steps to protect a data subject. Theres no expectation that you anticipate all mathematical possibilities...
> That’s wrong. Data protection legislation expressly forbids
I'm sorry, I assume that English is not your first language. 'Can' means 'is able to'; 'may' means 'is allowed to.' The GDPR does not allow selling something, but it's still perfectly possible for someone to do so. People break the law all the time.
I raised the issue of can vs. may because it's germane to the issue of immutability. It is possible to build a system in which it is mathematically impossible (within arbitrarily-determined limits) to alter data; it is not possible to design a system in which it is possible to prevent someone from telling someone else something he knows. It's odd to me that the GDPR bans the former, desirable system.