AFAIK, it falls under PII. I realize some may not consider this personal info, but many others do. There are laws built around its protection and disclosure.

I think a failure to protect any data, including PII, is harmful to the user experience and a brand's image.