The best way to solve this is to have a normalized schema. You assign each user an ID, and then you sync all the identifying information to its own table. So you get a schema that looks like:

  events (id, user_id, ...)
  users (id, first_name, last_name, email, ...)

If a user requests to be deleted from your database, or if you have a policy of deleting users when the cancel their subscriptions, you can accomplish that by deleting one row.

This isn't going to make you GDPR compliant by itself but it's a start.

Are the events not enough to re-identify the user? Not having a name literally in the database doesn’t make it anonymous.

As long as events don't have name/email/ip/... there should be no problem as far as i understand it. The regulation targets only personal identifiable information.

PII is a concept is US law. The GDPR uses personal data, defined as:

"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"

Pseudonymization (separating unique identifiers from the rest of the datapoints) can and should be used as a safeguard, but doesn't remove the need to protect the data, particularly if you keep a link between the two.

If you were a bookshop and your events log someone anonymous as buying a book on niche topics A, B and C, I reckon that could easily globally uniquely identify me as there aren't many people in the world interested in all three. Then you could also see me buying a book on embarrassing topic D and blackmail me with it. No personal identifying information, but it's not anonymous.

Finger-printing is not PII. And the people blackmailing you because you're interested in both finger painting and the orficial applications of pine cones would not be entirely sure it was you. If they had an email address, name, or IP address with a timestamp, then they could be quite certain it that it was you.

> Finger-printing is not PII

I didn’t say it was. The original conversation wasn’t about PII it was about anonymising. Fingerprints defeat anonymisation.

I reckon in practice with for example an Amazon sales log with names removed and my public Twitter feed you could de-anonymise me with a high degree of certainty.

No argument from me, there are things like IPs that are very hard to find every copy of and eliminate. Putting the users in their own table is just a simple best-practice that has a lot of benefits, so it’s a great first step.

I think GA did away with the restriction on PII last year or thereabouts.

No, it’s still there:

You will not and will not assist or permit any third party to, pass information to Google that Google could use or recognize as personally identifiable informatiom

Thanks for correcting my error. Now I wonder what I was thinking? I’m sure there was some change in the policy, I’ll do some research.