Issue national ID cards that contain a private key. For each citizen, the government would encrypt a mapping of their national ID number -> anonymized ID ("anonID") using their corresponding public key. The anonID could only be used to look up anonymized demographic data, updated when new IDs (and thus new encryption keys) get issued, once every few years. When checking out at the supermarket, your national ID number and private key would be used to generate your anonID on the spot, under which your purchases would be recorded. Demographers could thus freely query mappings from anonID -> demographic info/supermarket purchase history, without revealing anyone's actual identity. Without knowing one's private key (which is embedded only in their national ID card), it would impossible to freely map national ID -> anonID.