PII and describe how it is different from generic membership data, define workflow for dealing with it and/or rationale for not defining a workflow.

What’s PII:

Personally identifiable information (PII) and personal data are two classifications of data that often cause confusion for organizations that collect, store and analyze such data.

The most common definition for PII (in the US) provided by the National Institute of Standards and Technology (NIST):

It says that:

PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

However, the line between PII and other kinds of information is blurry. As stressed by the US General Services Administration, the “definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified”.

According to NIST, PII can be divided into two categories: linked and linkable information.

Linked information is more direct. It could include any personal detail that can be used to identify an individual, for instance:

• Full name
• Home address
• Email address
• Social security number
• Passport number
• Driver’s license number
• Credit card numbers
• Date of birth
• Telephone number
• Owned properties e.g. vehicle identification number (VIN)