I was reading about the UK's upcoming GDPR implementation on the BBC earlier, and I assumed the ban on reidentification would apply to service providers and businesses etc., and not to researchers or private individuals with legitimate intentions.

Is this not the case?