Developments in the rules governing Personal Identifiable Information may have unexpected consequences for lenders and other businesses