Is this intended to do PII filtering, or just santisation?

If it's intended to do PII filtering, we should get someone else to look at it as well, and consider introducing a fail-safe test before return that validates it matches a specified regex, otherwise drops the entire data.