One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.