This depends on the jurisdiction you're in. I.e. Europe's GDPR argues that you need consent to keep someone's personal data. Encryption doesn't equate anonymization, so there's a potential liabity.