Adding a new datatype "encrypted" would increase the data security.
I thought about a "public key" encryption (just a first draft)
First at all roles are extended so that they can store a public key, which belongs to the role.
When a new encrypted profile field is created. It is configured, which role (public key) this field belongs to.
If someone wants to read the encrypted data. He needs to be a part of the role and needs to know the private key.
Encryption and decryption could be done in javascript.
An example would be bank data.
There is a role for the organisations treasurer. And all bank data is encrypted with the treasurers public key. So only the treasurer can see the bank data.