All personal data should be public (in effect it is public after all leaks). Personal data should not be used for user authentication.