Also, I heard back from our commenter on issue #358, who reported that sub-issue (a) was the correct interpretation, and they noted our disposition of the comment. I added that the UMA Legal work may be of interest; they agreed (paraphrasing) that non-technical solutions would help with the potential problem with PII exposure they reported.