Worth caveating with what you should do if you don't/can't know that. For example, there were lots of debates in the early days of the Individual Electoral Registration project about whether National Insurance numbers were necessary. It was only after lengthy discussions with CESG about information security and testing with other systems to determine how the confidence algorithms could work that a decision was made.