Comment by chaosite

That's really not how GDPR works. If it's possible to derive PII from some other data (like activity data), then it's also considered PII under GDPR.

And it's definitely possible to derive PII from activity data.