1) If the companies get bought then GDPR doesn't stop the purchaser getting the data. Happens more often than you might think. 2) Properly anonymising data (w

1) If the companies get bought then GDPR doesn't stop the purchaser getting the data. Happens more often than you might think. 2) Properly anonymising data (while retaining value) is much harder than you think, and there have been repeated instances where such data got reassociated with individuals. I've had to do a bit of this myself and I think that I got it right, but it is difficult to be totally sure.