If an organization stores personal information on their website/web application (e.g. database) GDPR states that that given organization should be able to determine and report who accessed what personal information if for example an inquiry is made. Does that mean that for example an user identifier of some sort should be add to HTTP request logging in server logs?
If yes, wouldn't that be against GDPR as after that a specific user could be profiled and followed? If the server logs gather user IP addresses for security reasons wouldn't gathering also an user identifier cause the gathering of IP addresses being then against GDPR as now the user and the IP can be directly connected?