Comment by Gipetto

Gather enough non-PII data and that trove of information can sometimes itself build an identifiable picture of a person. PII in aggregate is still a problem in a GDPR conscious organization.