4.2.2.6 Protection of Personally Identifiable Information