IANAL but I thought removing non-PII mostly boiled down to risk since gdpr has big teeth. With a lot of money on the table and a licence attached to post they may feel it’s worth pursuing. They’ve probably been setting up protections for this for a while.