Absolutely, that's "data minimisation" in GDPR! All of the data collected should have been available only to the doctors with a need and researchers should have

Absolutely, that's "data minimisation" in GDPR! All of the data collected should have been available only to the doctors with a need and researchers should have gotten an anonymised DB. But there is a problem of ML-assisted deanonymisation, so it cannot be a solution alone.