I don't think there is an agreed upon definition of "personally identifiable information" at the edges, therefore I doubt that the GDPR got it right. For examp

I don't think there is an agreed upon definition of "personally identifiable information" at the edges, therefore I doubt that the GDPR got it right. For example, when the RIAA was suing everyone for pirating music...it was claimed by the tech community that an IP address is not enough to personally identify someone for a lawsuit. But the GDPR claims that IP addresses are PII. Which is correct? Our choices are live in a world where website operators can't log an IP address, but the RIAA or anybody can use an IP address to target someone for a lawsuit? Or we can live in a world where website operators can log an IP address, but the RIAA can't use an IP address to target someone for a lawsuit. And your knowledge of their backend is relevant, because you made a claim about its behavior - specifically that it would be easy to stop abuse for everyone. But what if parts of their system rely on, say, a logged IP address to aggregate some statistic that is important for the business folk? It might require reworking a large portion of their backend if they need to derive this non-abusive information in a different manner.