You contradict yourself, either its PII or not. Common understanding in the industry is that it is. Purpose of security doesn't change if its PII or not. Although security/auditing might allow to hold on for longer because you need the PII as a feature (which you should be transparent about). For pure telemetry you don't need it, I'd claim.
IPs can be PII under certain circumstances, but not the ones I laid out.
> Purpose of security doesn't change if its PII or not.
Security is the legitimate interest, an important part of collection under GDPR.
Re:GDPR: Removing Monal from the EU
by kasey_junk on Thursday May 17, 2018 @06:45PM
(#17096787)
PII is not the standard for GDPR compliance.
That came from the legal departments from our German, UK, and French entities.