I wouldn't be the best person to write about this, since it's unusual for me to do research involving PII. But it's an important enough concern that I'd be willing to do a first draft of a notification / advisory box for the documentation, in hopes that better-informed people like @User or others might refine it from there.