Although all the other permissions for limited administrators are restricted to the groups they manage, anyone with console access and permission to manage installation packages can enable the option to collect user data for the entire SEP domain.
In a large global environment (65,000 users/435 locations) this has wreaked havoc with users when the form pops up unexpectedly. It also poses a privacy issue in some countries that have very restricted regulations on PI collection.
Recommendation: It would be preferable to be able to selectively turn the option on/off at the group level. If that's not feasible, the ability to enable\disable user data collection should be limited to only domain administrators.