> OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I believe this is

> OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I believe this is actually fine if they can show they don't hold this data longer than necessary and have a process for destroying it in a timely fashion. But IANAL either