WOT Wiki:Personally Identifiable Information (PII)

Personally Identifiable Information (PII)

The protection of PII is important to maintain public trust and confidence in an organization, to protect the reputation of an organization, and to protect against legal liability for an organization. Organizations have always considered trust, confidence, and reputation as motivating factors in protecting PII. Recently, organizations have become more concerned about the risk of legal liability due to the enactment of many US federal, state, and international privacy laws.

Examples of PII Data

The following list contains examples of information that may be considered PII.

• Name, such as full name, maiden name, mother’s maiden name, or alias

• Personal identification number, such as SSN, passport number, driver’s license number, taxpayer identification number, patient identification number, and financial account or credit card number.

• Address information, such as street address or email address.

• Asset information, such as Internet Protocol (IP) or Media Access Control (MAC) address or other host-specific persistent static identifier that consistently links to a particular person or small, well-defined group of people.

• Telephone numbers, including mobile, business, and personal numbers.

• Personal characteristics, including photographic image (especially of face or other distinguishing characteristic), x-rays, fingerprints, or other biometric image or template data (e.g., retina scans, voice signature, facial geometry).

• Information identifying personally owned property, such as vehicle egistration or identification number, and title numbers and related information.

• Information about an individual that is linked or linkable to one of the above (e.g., date of birth, place of birth, race, religion, weight, activities, or employment, medical, education, or financial information).

Source

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) PDF

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology

January 2009