Under the Personal Information Protection Law (“PIPL”), data controllers are subject to more stringent requirements when processing sensitive personal information, such as more stringent protective ...