> You can still look up their data from their current email or phone number, for instance. Indexes are not limited to the primary key.

This is the key point, I think. Searching is not the same as identifying.