There are laws about how to handle PII and potential criminal charges based on things like the Privacy Act. Meaning there are additional requirements above and beyond how people normally store data on a system.
More requirements = More chances to mess up