doesn't clarify how much information you already have about the individual. There is a distinction between being able to identify someone without any prior knowledge about them vs re-identifying them. I don't think the GDPR is clear about that.
Would that example fall within the remit you outline and as such - skirt the whole GDPR aspect?