Legally, of course it’s PII — but is it sensitive information if you treat it as public and distribute it yourself?

I’m speaking to the functional cybersecurity angle, not the semantics of PII.