European Union is one of the most regulated places on how to deal with Personally Identifiable Information.
I was going to answer this question by saying that he had to hash the user password because of EU regulations, but I am not so sure.
So, of the login information/metadata below, what falls under EU PII regulations?
- Username (email)
- Secret questions and answers
- Phone number (for two-factor authentication)
- IP addresses the user has logged in from