Just say its for security and privacy reasons and make these users sign a statement saying if they won't agree then they will be held responsible for any breach or hack and see how easily it gets deployed. End of the day it all comes down to the decision makers and most of them in IT are spineless bunch because I think most of their life they have spent time doing customer service.