The first questions I'd ask myself is probably, is that data properly encrypted? And is it properly anonymized?