Thanks for sharing! I'm curious about the exact dividing line between PII and non-PII. So if you know, could you clarify a detail?

Your phrasing was: "If the hashed password *is used as* a lookup key, that makes it a unique identifier, and it's PII."

If I take your wording literally, your saying that I could store everyone's SSN in a database, but as long as my system didn't attempt to use SSN as a unique identifier, the SSN doesn't count as PII.

But it seems unlikely that that's how you meant it.