I've been thinking about PII in this context. If all data is secured by default, then the identification of PII is not about deciding to secure that data, it i

I've been thinking about PII in this context. If all data is secured by default, then the identification of PII is not about deciding to secure that data, it is about identifying where we might impose (and often this isn't required, but now we can consider it) additional UX burden or complexity in order to add _additional_ security.