12 minutes of reading

Updated on: March 12, 2024

What is PII?  

Personally Identifiable Information is any information that can be used to identify someone. This can include direct information such as name and Social Security number or indirect information such as race and gender. Any information that can be traced back to an individual is considered PII.

It’s important to note that the definition of PII isn’t regulated by any singular law or regulation, meaning that it can vary depending on your location. However, the US Department of Labor defines Personally Identifiable Information as:

“Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. Further, PII is defined as information: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors). Additionally, information permitting the physical or online contacting of a specific individual is the same as personally identifiable information. This information can be maintained in either paper, electronic or other media.”

What qualifies as PII

There are two types of information that qualify as PII. 

  1. Information that can be used to identify an individual on its own 
  2. Information that can be used to identify an individual when grouped with other identifiers 

The latter is known as “quasi-identifiers” or “pseudo identifiers” and includes information such as gender, zip code, and age. Individually, they can’t be used to identify someone, but they could when looked at together. This type of information isn’t universally recognized as PII, however. You should check your local legislation to find what qualifies as PII in your area.   

Why is it important to remove PII from the internet? 

Personally Identifiable Information can enable identity thieves and other cybercriminal to access to your financial accounts and credit records. Cybercriminals can use your personal information to send you targeted scams and spam. Cyber extortion, doxxing, and online stalking are other common risks.

Most companies claim they need your PII to optimize user experience. While this is true, many companies also use the data they collect for purposes other than what they openly advertise such as:
– Influencing your purchases
– Keeping you on their website longer
– Selling your information to data brokers
– Sharing your data with unsafe apps and third parties

How does PII get online?

Believe it or not, you are the main culprit in creating your digital footprint. You put a lot of your personal information online through the websites and apps you use. The good news is that you have control over how much. You can (and should) also stop using any websites or apps that demand too much data as well as those you just don’t need.

Here are some of the biggest ways you put your own personal information online:
– Google (check out our guide on how to remove your info from Google)
– Email accounts
– Smartphone apps
– Social media-
– Dating sites
– Personal websites
– Blogs
– Online shopping sites
– Shopping loyalty programs
– Apps downloaded on your phone
– Browser Extensions

Even when these companies don’t deliberately use your personal information in a careless or harmful way, there are still many associated dangers. For example, there were 1,862 data breaches in 2021 alone. A record high in an alarming upward trend in yearly data security breaches.

The biggest culprits when it comes to collecting your personal information without your knowledge are:
– People-search sites
– Data brokers
– Tracking technologies such as browser cookies
– Phone companies
– Banks, credit cards, lenders

The government is another big source of the data you have online. While this information is necessary for the government to have, it’s often easily available for strangers and companies like data brokers to exploit. 

The information the government provides includes:
– Birth records
– Death records
– Marriage records
– Licensing records
– Driving records
– Court records
– Criminal records
– Immigration records

What are some examples of PII?

The sensitivity and regulations surrounding the handling of such information may vary depending on the jurisdiction and the context in which the information is collected and used. Examples of PII may include:

  1. Full Name: John Doe
  2. Address: 123 Main Street, Cityville, State, 12345
  3. Phone Number: (555) 555-1234
  4. Email Address: john.doe@example.com
  5. Social Security Number: 123-45-6789
  6. Date of Birth: January 1, 1980
  7. Driver’s License Number: ABC123456
  8. Passport Number: A12345678
  9. Bank Account Number: 1234567890
  10. Credit Card Number: 1234-5678-9012-3456
  11. Biometric Data: Fingerprints, retina scans, etc.
  12. Medical Information: Health records, prescriptions, etc.
  13. Employment Information: Job title, salary, etc.
  14. Online Account Credentials: Username, password, security questions.
  15. IP Address: A unique identifier for internet connections.
  16. Vehicle Registration Number: ABC123
  17. Social Media Account Information: Usernames, profile details.
  18. Tax Identification Number: TIN or EIN.
  19. Health Insurance Information: Policy number, coverage details.
  20. Student Records: School ID, academic performance.
  21. Criminal Records: Mugshots, fingerprints, arrest records.
  22. Ethnicity or Race Information: Categorized demographic data.
  23. Military Identification: Service number, rank, and branch.
  24. Occupation and Employment History: Workplaces, job titles.
  25. Travel Information: Itinerary details, boarding passes.
  26. Biographical Details: Hobbies, interests, and affiliations.
  27. Emergency Contact Information: Names, phone numbers.
  28. Voice Recordings: Phone call recordings or voice messages.
  29. Photographs: Especially if linked to other identifying information.
  30. Financial Information: Investment portfolios, financial statements.
  31. Utility Account Numbers: Gas, water, or electricity account details.
  32. Social Services Information: Welfare or government assistance records.
  33. Employee ID Numbers: Company-assigned identification for employees.
  34. Device Identifiers: MAC addresses, IMEI numbers, or serial numbers.
  35. Genetic Information: DNA profiles or genetic testing results.
  36. Vehicle Identification Number (VIN): Unique codes for automobiles.
  37. Library Card Number: Identifying information tied to library usage.
  38. Subscription Services Data: Information from streaming, magazine, or other subscription services.
  39. Membership IDs: IDs for clubs, organizations, or professional associations.
  40. Vendor or Customer IDs: Business-specific identifiers for transactions.
  41. Social Security Benefits Information: Benefit statements and details.
  42. Pension Account Information: Retirement fund account details.
  43. Loyalty Program IDs: Reward program memberships and points.
  44. Online Purchase History: Details about items bought online.
  45. Employee Biographical Data: Personal details collected by employers.
  46. Survey Responses: Personal details shared in surveys or feedback forms.
  47. Job Application Information: Resumes, cover letters, and job history.
  48. Education Grant Information: Details about scholarships or grants.
  49. Census Data: Information collected during national or demographic surveys.
  50. Legal Documents: Marriage certificates, divorce decrees, or court records.
  51. Digital Signatures: Unique electronic signatures used for authentication.
  52. Asset Information: Details about property ownership, investments, or valuables.
  53. Employment Contracts: Details about terms of employment.
  54. Trade Secrets: Proprietary business information.
  55. Conference or Event Registration Data: Information provided during event sign-ups.
  56. Social Security Earnings Statement: Income details tied to Social Security.
  57. Gambling Account Information: Details about online betting or casino accounts.
  58. Healthcare Provider Information: Information about healthcare professionals.
  59. Home Security System Codes: Access codes for security systems.
  60. VoIP Call Records: Details about Voice over Internet Protocol calls.
  61. Peer Reviewer Information: Details about individuals who review scholarly articles.
  62. Homeownership Records: Details about property ownership and mortgages.
  63. Wire Transfer Information: Details about electronic money transfers.
  64. Trademark Registration Information: Details about registered trademarks.
  65. Professional Licensing Information: Details about licenses for various professions.
  66. Influencer Agreements: Contracts and details for social media influencers.
  67. Financial Aid Information: Details about student loans or grants.
  68. Job Evaluation Records: Information related to employee performance evaluations.
  69. Court Orders: Legal documents issued by a court.
  70. Visitor Logs: Records of individuals visiting a particular location.
  71. Employment Eligibility Verification (I-9) Form: Details about an employee’s eligibility to work in the U.S.
  72. Personal URLs or Usernames: Custom web addresses or online usernames.
  73. Health and Safety Incident Reports: Records of workplace accidents or injuries.
  74. Occupational Health Records: Information related to workplace health assessments.
  75. Customer Feedback Surveys: Responses to feedback requests from businesses.
  76. Public Records: Information available through government agencies.
  77. Criminal Justice Records: Information related to criminal investigations or proceedings.
  78. Insurance Claims Information: Details about filed insurance claims.
  79. Employment Authorization Document (EAD): Document issued by the U.S. government for work authorization.
  80. Website Analytics Data: Information about website usage and visitors.
  81. Client Agreements: Contracts or agreements between businesses and clients.
  82. Biological Samples: DNA, blood, or other biological material used for testing.
  83. Travel Reservation Details: Information about booked flights, hotels, or rental cars.
  84. Genomic Data: Information about an individual’s genetic makeup.
  85. Healthcare Billing Information: Invoices and records related to medical expenses.
  86. Commercial Lease Agreements: Contracts for renting commercial properties.
  87. Emergency Evacuation Plans: Plans detailing procedures during emergencies.
  88. Disability Records: Information about an individual’s disabilities and accommodations.
  89. Utility Usage Data: Information about electricity, water, or gas consumption.
  90. Livestock Identification Tags: Tags used in agriculture to identify individual animals.
  91. Patent Filings: Information related to filed patents and inventions.
  92. Parental Consent Forms: Documents granting permission for activities involving minors.
  93. Voter Registration Information: Details recorded when individuals register to vote.
  94. Event Ticket Purchases: Information about tickets bought for concerts, sports events, etc.
  95. Library Borrowing Records: A history of books or materials borrowed from a library.
  96. Public Assistance Records: Information about government aid or assistance programs.
  97. Retirement Account Information: Details about individual retirement accounts (IRAs) or pensions.
  98. Immigration Documents: Visas, green cards, or other documents related to immigration status.
  99. Social Media Posts: Content shared on social networking platforms that can reveal personal details.
  100. Employment References: Information provided by previous employers about an individual’s work history.
  101. Vendor Contracts: Agreements with suppliers or service providers that may include personal information.
  102. Webinar Attendance Logs: Records of individuals attending online seminars or webinars.
  103. Customer Loyalty Program Data: Information collected through customer loyalty programs.
  104. Police Incident Reports: Reports detailing incidents involving law enforcement.
  105. Employee Time and Attendance Records: Records of hours worked by employees.
  106. Employee Benefits Information: Details about workplace benefits, including health insurance and retirement plans.
  107. Membership Lists: Lists of individuals belonging to clubs, organizations, or associations.
  108. Internet Search History: Records of online searches conducted by individuals.
  109. E-commerce Transaction Data: Details about purchases made

What doesn’t qualify as PII?

Any information that doesn’t fall into one of the two categories described above generally doesn’t qualify as PII. This could be statistics on the use of a product, age range, masked IP address, or information collected by the government for a census. 

In short, if the information can’t be used to positively identify an individual alone or grouped with other quasi-identifiers, it is not considered PII. 

Types of PII

There are two main types of PII: non-sensitive and sensitive.

Non-sensitive PII

Non-sensitive PII is information that is not considered sensitive and can typically be shared without much concern. 

Examples of non-sensitive PII include:

  • Age
  • Gender 
  • Race 
  • Occupation
  • Education level 
  • Religion 
  • IP address
  • Mac address

Sensitive PII

Sensitive PII is information that is considered private and shouldn’t be shared, except under specific, limited circumstances and with great care. In the wrong hands, this kind of information can be used to scam, ransom, stalk, harass, or steal the identity of the person the information belongs to. 

Examples of sensitive PII include, but are not limited to:

  • Full name
  • Social Security number
  • Driver’s license number
  • Passport number
  • Address
  • Email address
  • Phone number
  • Bank account number
  • Credit card number
  • Medical records
  • Fingerprints
  • DNA

Laws protecting PII around the world

Since there is no universal definition for Personally Identifiable Information, it’s important to be familiar with your local data privacy laws and regulation. Here is a brief overview of some of the privacy laws in different countries:

United States

In the United States, there are several laws that protect PII. The most well-known is the Health Insurance Portability and Accountability Act (HIPAA), which protects the PII of individuals in the healthcare industry. The Federal Trade Commission (FTC) also has regulations in place to protect PII, such as the Fair Credit Reporting Act (FCRA) and the Children’s Online Privacy Protection Act (COPPA). 

Additionally, 5 states have comprehensive data privacy laws. These include:

If you live in another state and want to know which laws and regulations protect your PII, you can find a detailed state privacy legislation tracker here. 

Europe

In Europe, PII is protected by the General Data Protection Regulation (GDPR). This regulation applies to all organizations that process the PII of individuals in the European Union (EU). It gives individuals more control over their PII and requires organizations to be more transparent about how they use PII.

Canada

Canada has one centralized law that protects PII called the Personal Information Protection and Electronic Documents Act (PIPEDA). This law regulates how private sector organizations can collect, use, and disclose personal information.

Australia

In Australia, PII is protected by the Privacy Act 1988 (Privacy Act). This law regulates the collection, storage, use, and disclosure of personal information, whether by the federal government or private entities. Later amendments regulate the use of healthcare identifiers and establish the obligations of entities that experience data breaches.

New Zealand 

In New Zealand, PII is protected by the Privacy Act 2020, which governs the handling of personal information in New Zealand. It aims to provide stronger protection for individuals’ personal information and places more obligations on organizations to protect that information. It also gives individuals more rights in relation to their personal information, including the right to access and correct that information.

How to Protect your PII

While it is not possible to completely protect yourself from PII theft, there are steps that you can take to reduce the opportunities for thieves to steal your information.

  • Lock your mailbox or PO box to make it harder for thieves to steal your PII.
  • Remove personal identification from junk mail and other documents.
  • Avoid carrying more PII than you need.
  • Use a unique, complex password for each online account.
  • Encrypt your sensitive data.
  • Use a unique password for the device you own.
  • Reformat your hard drive whenever you sell or donate a computer.
  • Optimize the privacy settings on social media and be cautious about sharing too much.
  • Be extra cautious about revealing too much data on your children.
  • Check for breached passwords on Have I Been Pwned? and similar websites.

It is important to weigh the convenience of certain services against the potential risks to your privacy. While it may be convenient to log in to services with credentials from platforms such as Facebook or Google, it also means more access points for hackers if they gain access to one of your accounts.

PII theft is a serious issue that affects many people. By being aware of the tactics used by thieves and taking steps to protect your information, you can reduce the risk of becoming a victim of identity theft.

Is this article helpful?
YesNo
Scroll to Top