In the abstract, yes.

In the case of a university like the head of this thread, it isn’t going to be easy to avoid collecting and retaining data.

that's the odd thing: we simply don't ask whether there's an alternative.

for instance, how many companies (including universities) store their own cash on prem? what if we treated PII like cash? limit amount and time kept outside the data "bank" (which would be a third party specialized for security and authenticating access).