We really should be asking more “why do you need that info?” “where are you storing it?” “who has access to it?” “how long are you keeping it?” etc.