The broad CCPA definition of personal information could open a can of worms for compliance and governance.