I remember 1980s government policy reasons for refusing to collect individual personal information outside the scope of project mandate or the law were 1) it costs money to collect it, 2) it costs money to store it, 3) information cannot be secured indefinitely, 4) the cost to victims of disclosure would be high, and 5) the liability of #4 isn't worth it