All aspects of the privacy and data security of the research are the ultimate responsibility of the PI. (Though of course, you should not take this to mean that you have no responsibilities yourself!) In your case it would be a good idea to report your concern directly to the PI for the study, to ensure that it is known. It is fairly common for research work to be undertaken without anonymising the data, unless this is required for the purposes of blinding protocols in the study. However, if there is a reasonable prospect of researchers accessing sensitive data for people they know, then the PI should really be applying some anonymisation protocol to prevent this.
As a research assistant for the study, you have a responsibility to maintain confidentiality of the information you access, and you should also avoid specifically accessing the data for a person you know, other than for bona fide research purposes. In the event that there is a data breach in your study (e.g., a research assistant disclosing data outside of the team), your PI could definitely find him/herself in hot water.