Does “personal information” include aggregate or de-identified information?