> Keep identifying information (IP, UID, DoB, etc) in one table, and activity data in another, with a join linking the two. You just made the log no longer sim

> Keep identifying information (IP, UID, DoB, etc) in one table, and activity data in another, with a join linking the two. You just made the log no longer simple. Now writing a log line isn't a matter of writing bytes to disk; it's a matter of looking up PII in one table, reading a key, then writing the key and the non-PII to disk. If the definition of PII gets more expansive … whoops. > The degree of panic it's causing baffles me though. Sure, it requires design up front. Oh woe. But regulatory compliance always does. You answered your question. The compliance costs, and it's for what is IMHO a non-right. I do not, and no-one has, a right to demand that my IP activity be erased. I do not, and no-one has, a right to change history. Much of the rest of the GDPR is wonderful stuff, but the so-called 'right to be forgotten' is Orwellian.