If there is a procedure in place, you follow the procedure. You can argue how the procedure is ass backwards, but you don't just ignore the procedure because it's giving you bad vibes.

Especially with PII. Every junior I've mentored, every team member I've been responsible for, every one has gotten (thankfully, mainly preemptive) stern talking to regarding handling PII. Much better to be laughably paranoid for hundred times, than leaking some of the truly radioactive data once.

> The people who make “Form 7005” are the ones we hate, remember?

Er, I mean, yes, when handling sensitive data, papertrails are good, actually.