Here's where it gets tricky: You can't identify individual users in Google Analytics for Personal Identifable Information. (PII).
However, if you already explicitly storing user data you can 'do the math' on it and identify the User's individual behaviour (i.e. users who have been on page orderid=211, you can view that user's behaviour with simple analytics segmentation).
Google are very adherent to PII, because that's the main 'Gotcha' for analytics privacy compliance.
But identifying who someone is without PII with an external resource that does safely store PII such as your CRM, integrating their GA analytics isn't hard and as long as PII is kept out of GA you should be ok.
Google Analytics, itself explicitly, wouldn't be violating the privacy laws even in the EU nations to my knowledge (DISCLAIMER: Talk to a lawyer, especially a technology specialist because other lawyers are useless).
If you are running an ecommerce site and GA, you should be stating that you are storing their information and be transparent with that data.
But even with the most vanilla ecommerce set-ups, you can identify on a person-by-person basis with very basic segmentation - just 80-90% of people don't know how to do it.