How the Catalan government uses IPFS to sidestep Spain's legal block
I would have used scrypt (memory bound and therefore hardly scalable in ASICs/FPGAs) with a higher round count, say that it takes ~1s to calculate the hash. That way bruteforce is infeasible these days.
Also I would have used other sparse information such as street number that hardly can be connected to a particular person.