One of the study’s recommendations, if I recall correctly, is for deidentifying log data, e.g., having all logs generate two parts, joined via pseudonyms, so that Log A would contain all the transactional information one might need as a network administrator, while Log B could match actual users (or their IP addresses, which might amount to the same thing) to those transactions. While Log A might be kept for a while, Log B might be routinely purged; you might also encrypt Log B so that information could be recovered, but only with difficulty (e.g., requiring a subpoena, or whatnot).