Is the current definition of personal information enough to protect individuals from privacy harms?