How is this not considered PII and subject to all of the disclosure and control requirements we all must abide by? May an employer opt out?