Having this in userdb is not bad per se. We already have a bunch of PII in there.

I like the analogy of data as oil: polluting when it gets out.

I'd like to severely limit the amount of PII on the system.