Why not? Every system holding PII poses a potential threat, at the very least because every system can get hacked, and at worst because folks with “legitimate”

Why not? Every system holding PII poses a potential threat, at the very least because every system can get hacked, and at worst because folks with “legitimate” access to that data can still abuse it.