Does anybody know what the legal situation (in US or under the GDPR) is for data derived from inferences? E.g.: if he visits this nightclub he's gay, or if she goes to this clinic she's having an abortion. As the subject never told you, but rather you speculated it, it could be argued you don't know, and you don't have to record it in explicit terms. It also raises significant concerns about the accuracy, and whether the subject can even correct, let alone expunge such data, which could be sold on to credit rating agencies or whomever else.