Yes. And in this example it'd be even easier to identify you if you lived in a much more sparsely populated postcode. But then maybe you 'fuzz' geographic (or other) info in the data set so that it can never point to fewer than say 1000 people. But that might reduce its usefulness in a particular method of vaccination effectiveness tracking....
(This isn't my specific area of GDPR, I look at a small part of customer record handling for a large company. But it's taken years, a lot of money, lawyers and consultation with EU/UK regulators etc to get from GDPR policy to high level rules that can be applied, let alone actually implementing them).
Yes. And in this example it'd be even easier to identify you if you lived in a much more sparsely populated postcode. But then maybe you 'fuzz' geographic (or other) info in the data set so that it can never point to fewer than say 1000 people. But that might reduce its usefulness in a particular method of vaccination effectiveness tracking....
(This isn't my specific area of GDPR, I look at a small part of customer record handling for a large company. But it's taken years, a lot of money, lawyers and consultation with EU/UK regulators etc to get from GDPR policy to high level rules that can be applied, let alone actually implementing them).