Understanding Personally Identifiable Information
Personally identifiable information (PII) is data that can identify an individual either on its own or when combined with other relevant information.
PII contains direct identifiers like passport information that uniquely identify a person, or quasi-identifiers like race when combined with other identifiers such as the date of birth.
Key Takeaways
- PII uses data elements to confirm an individual’s identity.
- Sensitive PII encompasses items like full name, Social Security Number, driver’s license, financial and medical info.
- Non-sensitive PII can include details accessible via public sources like zip codes, race, gender, and birth dates.
- Passports contain sensitive PII.
- Information on social media sites might be considered non-sensitive PII.
The Digital Age and Big Data
The rise of digital technologies like cell phones, the internet, e-commerce, and social media has generated massive volumes of all forms of data—known as Big Data.
Businesses collect, analyze, and process this data, sharing valuable insights to enhance customer interactions. However, this availability has also escalated data breaches and cyber-attacks, raising concerns about properly handling sensitive consumer data.
Types of PII
Sensitive PII
Sensitive PII includes legal identifiers such as:
- Full name
- Social Security Number (SSN)
- Driver’s license
- Mailing address
- Credit card information
- Passport information
- Financial information
- Medical records
To mitigate risks, companies often encrypt and anonymize sensitive PII using various techniques.
Non-Sensitive PII
Non-sensitive or indirect PII is easier to access from public domains like phonebooks and includes:
- Zip code
- Race
- Gender
- Date of birth
- Place of birth
- Religion
While non-sensitive data alone cannot reveal an individual’s identity, it can become identifiable when combined with other quasi-identifiers.
Protecting Personally Identifiable Information
Multiple countries have enacted laws to guide the collection, storage, and sharing of personal data. These laws often dictate scenarios under which sensitive information can be collected, how and when it should be deleted, and stringent data sharing guidelines. cybercriminals commonly breach data systems to access PII, selling it in underground markets for illicit gains.
How PII Is Stolen
Identity thieves often find PII by rummaging through people’s trash for unopened mail, revealing names and addresses, and even employment or banking details. The internet serves as a significant vector for identity theft where phishing and social engineering attacks deceive individuals to disclose personal details.
Tips to Safeguard PII
Reducing your vulnerabilities can make you a less attractive target for identity thieves. Steps you can take include locking your mailbox, removing personal IDs from documents before discarding them, and avoiding the unnecessary carrying of critical identifiers like your social security card.
Online security can be bolstered by utilizing complex, unique passwords for various accounts and ensuring sensitive data is encrypted. Additionally, formatting hard drives before selling or donating electronic devices reduces the risk of leakage.
PII Regulations Worldwide
United States
In the U.S., PII is defined as data that can ‘‘distinguish or trace an individual’s identity.’’ It includes identifiers, both singular and combined, like SSN and biometrics.
Europe
The European Union’s definition, under the GDPR encompasses a broader spectrum of identifiers and includes quasi-identifiers, enabling a comprehensive framework for collecting and processing personal data.
Australia
The Privacy Act 1988 in Australia governs the control over the collection, storage, and sharing of personal data, including mechanisms for addressing data breaches.
Canada
The Personal Information Protection and Electronic Documents Act regulates commercial use of personal data, ensuring it cannot identify individuals unless combined with other information.
The Big Picture on PII and Breaches
There have been significant instances of PII breaches resulting in hefty fines. Among the most notable was a $1.1 billion fine against Didi Global by the Cyberspace Administration of China.
Meta-Facebook Cambridge Analytica Scandal
Facebook saw 30 million user profiles collected by Cambridge Analytica through loopholes, without the users’ consent. The scandal led to legal expenses, reputational damage, and billions in fines.
Final Thoughts
PII can define an individual and can be anything from a name or address to highly sensitive details like financial records and social security numbers. Companies and government entities must maintain robust security measures to safeguard this information as identity theft threats surge.
Related Terms: Personal Data, Data Breach, Identity Theft, Data Protection Laws, Anonymization, De-anonymization, Cybercrime.
References
- European Union. “Regulation (EU) 2016-679 of the European Parliament and of the Council of 27 April 2016”.
- United Nations Conference on Trade and Development. “Data Protection and Privacy Legislation Worldwide”.
- Internal Revenue Service. “IRS Statement on the ‘Get Transcript’ Application”.
- Experian. “What Is Personally Identifiable Information”?
- National Institute of Standards and Technology Computer Security Resource Center. “PII”.
- The European Commission. “Data Protection In the EU”.
- Office of the Australian Information Commissioner. “History of the Privacy Act”.
- Office of the Privacy Commissioner of Canada. “Summary of Privacy Laws in Canada”.
- CSO. “The biggest data breach fines, penalties, and settlements so far”.
- U.S. Securities and Exchange Commission. “Facebook to Pay $100 Million for Misleading Investors About the Risks It Faced From Misuse of User Data”.
- Federal Trade Commission. “FTC Issues Opinion and Order Against Cambridge Analytica For Deceiving Consumers About the Collection of Facebook Data, Compliance with EU-U.S. Privacy Shield”.
- Federal Trade Commission. “FTC Sues Cambridge Analytica, Settles with Former CEO and App Developer”.
- Meta. “Facebook Reports First Quarter 2019 Results”.
- The Federal Trade Commission. “FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook”.
- The New York Times. “For Many Facebook Users, a ‘Last Straw’ That Led Them to Quit”.
- U.S. Office of Privacy and Open Government. “Safeguarding Information”.
- U.S. Department of Justice. “The Privacy Act of 1974”.
- Federal Trade Commission. “Federal Trade Commission Act”.
