Of what I've read, and on Source of Title, too, I believe:

 The data we collect from various PUBLIC sites is public information.

 BUT, the issue becomes when that PUBLIC data is compiled into one convenient report, does it become Non-public Personal Information?  Many opinions higher up than mine reply, "Yes, now it is "private" and must be encrypted."

 I agree encryption is a PIA, but a necessary evil.

The problem:  In theory, if an e-mail account was hacked (danger lurking for NPPI) or will be hacked, do not sent the password in the cover e-mail or a separate e-mail.  Make a telephone call to talk to the recipient and verbally give the password.  This sounds good, but in practice is not always that easy to do or connect with the right person.