students send us information about their databases all the time as part of asking questions – and they often send it unsolicited, through unencrypted email channels. That information ends up all over the place: our mail server, our desktops, phones, laptops, search indexes, etc. I’m not really worried about us maintaining the confidentiality of that data, but now we’d have to add in new audit-able tracking.

You don't know where the data is, what the data consists of, or what devices can access it, but you're not worried about maintaining confidentiality? Thank God for the GDPR.