I'm not sure I'm well placed to answer that one, in terms of protecting the users. For that one, I would suggest you might want to talk to the Privacy Commissioner. I noticed the commissioner hasn't been here yet.
Protecting the privacy of the request, the personal information, is kind of a first-come, first-served system. The analysts are supposed to be addressing them as they come in and not classifying types of requests.
I'm not sure if I'm exactly getting at what you're asking.