My point was that once you make that data machine-readable, it's not good enough to have privacy-by-policy of not storing it - IT security being what it is.