Ok. But why would that be the law? Say my reference number is public on the internet, and the reference number is in a transaction log. That means that the tra

Ok. But why would that be the law? Say my reference number is public on the internet, and the reference number is in a transaction log. That means that the transaction log has information about me, that is not anonymized. Thanks to this reference log you can see my purchase patterns. And isn't "a database of people's purchase patterns" the exact thing GDPR is meant to control?