is someones birthdate, asking someones birthday can be a security question. Keeping data private is never the issue, its keeping the data disassociated from the owner. The VPN would be the weakest link with personal information following you back (using a free VPN would end up in records being kept of your activities).

though any extra security would be nice as you mentioned the chain is only as strong as its weakest link. Using a VPN creates an issue with its self as to obtain the VPN you would use personal information. Then once connected to the VPN you can use the Tor network that way.

Then once you have the anonymous VPN you would not want to connect to your VPN from your home address (though anonymous VPNs hold no data so technically you shouldn't be able to be traced from your home address). To also secure the purchase make bitcoin transactions and VPN transaction VIA Tor. To make it secure you would need to buy an anonymous VPN and pay for it in bitcoins after rolling your bitcoins via a tumbler (depending how you obtain the bit coins will determine your weak spot in the chain, but the tumbler should fix most of that issue). If you went VPN -> Tor, You would encrypt all of your traffic to your start point (The VPN Out interface) and then the Tor network would take over, the issue here comes with the VPN service its self, they could very easily see you are using the Tor network, this would be your weak spot you want to be under the radar with everything. Tor uses relays and your path changes every time you use Tor by using a VPN you would be using the same end point (assuming you went Tor -> VPN) If you were to use VPN and a Tor network you remove one of the security layers in the tor network. In theory yes, In practice maybe not but also yes at the same time.

Combining tor browser with vpn