Just because you do not yet have the capability to abuse the invasion of privacy you have already done, does not prevent you from doing so later. GDPR's goal w

Just because you do not yet have the capability to abuse the invasion of privacy you have already done, does not prevent you from doing so later. GDPR's goal was to make PII into "toxic materiel", to be only handled if you really, really need it and are willing to deal with the toxicity. Having a pool of toxic sludge and declaring everything is fine because you do not use it after filtering what was useful for you does not stop it from being a dangerous pool of toxic sludge.