Depends on the data, but everyone should be treating metadata at the same classification level as the underlying data. Perhaps even moreso, as metadata leaks i

Depends on the data, but everyone should be treating metadata at the same classification level as the underlying data. Perhaps even moreso, as metadata leaks information about the company, versus leaking data about the user. (Rightly or wrongly, things that harm the company are more likely to be prioritized.)