I would think it's too low with the current framing of the scope of subscriber information: the definition and the parties that can receive it. My recommendation is to fix the scope. If you fix the scope, I think you can keep the suspicion, but if you don't, that would be the alternative.
