Any system that relies on a UID is trackable, it just depends how much legwork you're prepared to put in.
That still requires more resources than mobile app tracking, and it's easier for people to disguise themselves against a camera rather than mobile app tracking, so mobile app tracking is the greater current threat.
But CCTV identification will improve and it will be harder to fool, so I don't want that either.
What I man by (probably) unlawful is not that they wouldn't have the right to collect that data due to public interests. And I am sure many locals wouldn't bother sharing their data with the city if it helps to improve its and hence theirs transport system (like it probably does). But you'd have to reverse engineer the app to see whether the data goes also to ad-tech and who knows who else. That's one thing.
And also a telecom has the data due to different obligations. But they also do business with it. That's the second thing. Also the smartphone manufacturer probably has it, and that's the third interesting thing.
But, now, under the GDPR, none of them "own" the data because it is your personal data. With this point, please also stop using the term PII. This covers anything and pretty much everything; like the author, I am interested in the geolocation data but I'm sure there's a lot more interesting stuff.
Then, under the GDPR---because it is your personal data and it "belongs" (for a lack of a better term) to you---you'd want to exercise the many rights granted to you by the laws, the GDPR and the Charter. Particularly, you'd want to exercise your rights to have your personal data and transfer it to another system in a portable manner. In fact, you want it real-time through a 24h API because it is your fundamental right.
Then, assuming you have your personal data from the city, from the telecom, and from the smartphone manufacturer, you can compete with them, do AI/ML with your personal data, do crowd-sourced science with others, do open data with open source, donate it to your favorite city in Europe or even the EU, or, hell, even sell your personal data if you want to.
That's why I wrote unlawful (probably).
The law assigns personal ownership of your data, to control you.
The farcical idea that some law will allow the individual to reverse decades of progress towards electronic identity systems (even for themselves) is a joke.
It's over for the British, the culture won. You cannot oppose cultural movements anymore, because they happen behind a computer screen. Britian is dead.
You can't say no to electronics. The cat behind the curtain could be anybody. A state, a corporation, a theocracy, ect.
Xi Jin Ping (or a Jihadist) could hypothetically set all the electronic rules in the UK and nobody would know the difference.
When a cultural revolution happens behind the electronic curtain, your conscience can't know it, or oppose it.
Severing control of one's behaviour, from the individual conscience and placing it in the hands of electronics.
Brings into existence total cultural control of Britian, without the ability for individuals to oppose it or understand it.
Our world used to run on written agreements and Kantian-esque moral emotions with Duty. None of that matters or has any influence over an electronic life. All that matters is the will, so told by the unseen electronic controllers.
Britian is dead and Britian is not allowed to know it.