> rule #1 should be not to collect data you don't have a safe way to process. GDPR or not this shouldn't even be collected. My understanding was that the law,

> rule #1 should be not to collect data you don't have a safe way to process. GDPR or not this shouldn't even be collected. My understanding was that the law, at least in England, required for this data to be collected and retained.