What I’m saying is that by isolating PII as much as possible you can make that larger task much easier to achieve.
You can actually learn a lot from places you might not think of at first like how intel agencies and LE do things like source protection where you have to deal with the concept of a particular identity in a lot of different scenarios and different groups but it’s essential that the person remain unidentifiable at the same time to almost everyone. It’s a very similar set of problems and they have been thinking about this for a long time already.
I don't think GDPR should have been enforced on existing systems as in many cases it became a tick box exercise. Best practice and certification for new development would have made more sense.
A slightly more realistic approach I’ve seen to a lot of these issues basically boils down to:
- minimise PII collection as much as possible in general and start thinking of it more like a liability than an asset.
- Isolate the actual PII in your backend and stop passing it around from system to system.
- start working more with “references” to the PII data which is isolated and can be tombstoned when required.
It takes a little bit of thinking around the concept of “identities” and a deep understanding of how data flows through your various systems but getting on that early right from the point of collection makes life a lot easier.