Personally Identifiable Information (PII)

A person’s full name, place of birth, IP address, X-ray, weight, driver’s license, financial data, gender, mailing address, medical records, biometric data, credit card information, religion, race, or ZIP code are all examples of PII. 

PII can be categorized into four key types:

1. Data that’s intended to distinguish (passport number, biometrics, government-issued ID)
2. Data that’s intended to trace (internet search history, behavioral biometrics)
3. Data that’s linked (full name, address, email address, license plate)
4. Data that is linkable (info that is often combined, such as zip code, gender, last name, or age).

Sensitive PII is personal data that needs extra protection, especially due to the risks that come if such data is exposed (for example, passport details, medical reports, or the person’s SSN). Non-sensitive PII, sometimes referred to as indirect PII, is data that can be obtained from public sources, such as the internet (for example, the individual’s gender, religion, or place of birth). 

Yes. Religion is sensitive, Personally Identifiable Information, along with other data points, such as race, biometric data, medical data, sexual orientation, and other details linked to underage individuals.

The US’s California Consumer Privacy Act (CCPA) is one of the most recognized data privacy laws in the world. Under the CCPA, companies that sell personal information must include a noticeable link on their website labeled “Do Not Sell or Share My Personal Information.” It grants consumers the right to know what personal information is being collected, its purpose, and who it’s shared with. The EU’s General Data Protection Regulation (GDPR) works similarly. 

Under both CCPA and GDPR, personal data or PII refers to information that directly or indirectly links to individuals and can be used to identify them.

Regulated entities, such as banks, fintechs, crypto, healthcare, and other high-risk platforms (that handle large cash flows or a high volume of users with sensitive data) are required by law to accept verified users, which means they need to review PII to ensure it’s not fabricated and the user is who they claim to be. This is often done by combining two types of verification: government-issued ID verification and biometric authentication or selfie verification. 

Automated systems like this extract PII, such as the person’s full name, address, date of birth, nationality, etc., from the document, and then, they’re asked to capture a selfie so that their biometric data (their facial features) can be assessed and matched with the picture on their ID document. Sometimes, online platforms additionally use database checks to see if the user’s provided information matches official, reputable government databases that also consist of different pieces of PII.

Criminals use stolen PII to commit fraud, including account takeovers on e-commerce sites or unauthorized purchases, as well as creating new accounts on fintech platforms or even taking out loans using stolen credentials. Alternatively, bad actors target data systems as a way to steal and sell PII on the dark web and other underground marketplaces.  

There are three key rules when it comes to PII and protecting sensitive information in general:

1. You should always delete data that’s no longer needed for its original purpose.
2. You should check all platforms’ T&C. Sensitive information should be collected in certain circumstances and only for security reasons. For example, when conducting identity verification as a way to open a bank account.
3. You shouldn’t share personal information with people who can’t guarantee its security.