Personal information is not clearly defined so it can mean anything. My guess is the search request is not directly linked to a specific user but a session to which that session is linked to a user so there isn't an identifiable person making a search without some backend data matching.