Pretty sure, the rights that European citizens get based on GDPR also apply when dealing with the government(s). Generally, governments are splintered into multiple parts and every part is only allowed to keep their relevant data.

Anyway, the government as a whole just doesn’t need to know what sites you visit and the companies don’t need to see your personal information or any identifier. If they can just check if that number correspond to a true or false, it’s enough.