In realistic terms, it is best to lessen access to sensitive data and produce anonymized copies for incompatible functions (e.g. analytics). It's also wise to doc a reason/lawful basis before collecting the information https://bookmarkity.com/story18332932/indicators-on-confidential-ai-intel-you-should-know