Here is a reference on PII that is relevant to the US. But you should do research into how PII is defined and what regulations are relevant to PII for wherever you are operating your site. You may also want to look into the same things where you are allowing users to use the site as you may also be held accountable in those locations.
It also may matter what you use as a username (e.g. Legal name, email address, etc)
It also may matter what industry you are operating within and what service you are providing, in case there are any extra regulations that you must follow.
Your customers trust you to protect the data you are holding, and you should err on the side of caution to avoid losing the trust of your customers.
The way to avoid most of these legal headaches, ambiguity, and security/privacy concerns: for this specific use case, is to use tokenization.
Do not expose data directly in urls (i.e. usernames, keys, identifiers, etc), rather map them to a token in session on the server. This way the numbers become meaningless when you expire the session.
In this case:
/users/bob/edit
becomes /users/42/edit