Data must be personalized yet anonymized at the same time