A substring could be used if we are sure that is never ever could be a user cpr/card number. It may be more safe just to do the sha1...