That's not entirely correct. So for example, let's say I ask users about users' name and address, and I ask their permission to store this under GDPR. In a se

That's not entirely correct. So for example, let's say I ask users about users' name and address, and I ask their permission to store this under GDPR. In a separate table, I store "anonymous" sensitive data, like which how many users in each country have a particular health issue, but it's "anonymous" so I never asked the user's permission to collect it. I am violating GDPR, because I can use my demographic data to identify some specific users who have some specific health conditions, and I never asked permission to do that.