Pseudonymization

No, that's a good... starting point now i'm thinking that the the problem with dpas as well is that very often they lack imagination and we apply the same measures so it's sort of i see people starting sort of doing the process of working it out upside down so i know the measures i can apply i know what i can say will mitigate no matter what happens i know i'm going to say I apply additional security.

I am doing data minimization or I anonymize, pseudonymize, whatever.

And because this is the arsenal of tools that I have, no matter what we do, I'm going to map the risks associated to this new app or this new campaign or profiling activity so that I can target some new customers, whatever.

And I'm going to tie it to this arsenal of tools that I have.

So how do the good ones resolve it?

Pseudonymization.

Replacing the name with a code and keeping the key that links them somewhere separate and locked down.

GDPR is largely satisfied because you can break the link on request without touching the science.