thanks for clearing that up. you were unclear that you were speaing in terms of utility rather than legality. legally you "can't" and "may not". To do so would be in breach of the law.

GDPR has expectations that Data Controllers take reasonable steps to protect a data subject. Theres no expectation that you anticipate all mathematical possibilities...