A hash of a public identifier like an email is personally identifiable data.

Isn’t the entire point of a cryptographically secure hash that you can’t derive the original information?

You can't derive the original better than guessing. With public identifiers you can just take a list of them and guess with those. If someone asks for your email they can hash it themselves and compare it against whatever databases.

You can always encrypt with a public key instead of hashing.

You mean 'as well as', right?

No, I mean encrypting (using a random padding like OAEP-RSA) gives an undecipherable item.