Personally Identifiable information (PII) and Personal Data Protection

By

Image : libguides
Personally Identifiable information (PII) is defined as any data that could potentially identify a specific individual. In simple, PII is any information that can be used to distinguish one person from another.  The legal definition of PII may vary from jurisdiction to jurisdiction. However,  universally it refers to information that can be used to trace an individual identity, with by one or more information that is linkable to a person.

Following are personally identifiable information. 

  • name
  • address
  • email
  • race
  • ethnicity
  • telephone number
  • date of birth
  • passport number
  • fingerprint
  • facial image
  • mother's maiden name
  • driver's license number
  • credit or debit card number
  • Social Security number/ID no

The reasons to protect PII are :

Protecting PII is important to ensure personal privacy.

Personal data is collected, recorded, processed, tracked and used daily. They include names, IDs , biometric scans with fingerprints, facial recognition systems used to login to systems and unlock devices. Therefore it is essential to protect individuals' identity by protecting information unique to them.

Sensitive vs. insensitive PII

PII can be categorized as sensitive or insensitive. Insensitive PII can be  transmitted in an unencrypted form without resulting in harm to the individual. They are available in public records, phone books, business directories and websites.

If disclosed sensitive PII could result in harm to an individual. They often has legal, contractual or ethical requirements for restricted disclosure. Therefore sensitive PII should be encrypted during transmission. They include  biometric data, medical information and unique information such as passport or Social Security numbers. Tax IDs, passwords, bank account information, email addresses are included in PII.

Banks, health services organizations, government agencies, businesses  have experienced data breaches , which making people vulnerable to identity theft with exposed PII. Hackers and thieves can sell PII for a significant profit, or they can open new, separate accounts using their victims' information to engage in bigger scams.

PII laws and regulations are 

The European Union's (EU) General Data Protection Regulation (GDPR), has become a de facto standard worldwide. It applies to any organization that collects PII from citizens in the EU. Personal Data Protection Act No 9 of 2022,

There are 7 principals that governs lawful processing of personal data, with regards to collection, organization, structuring, storage, alteration, consultation, use, communication, combination, restriction, erasure or destruction of personal data. 

The 7 principals of GDPR are:

  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimization
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality (security)
  • Accountability

They aims to minimize data collection, ensure storage limitation, and accountability, and requiring specific categories of sensitive data to have extra protection. 

The Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR). The CCPA (California Consumer Privacy Act) is the US equivalent of GDPR. It is a comprehensive data privacy act which gives Californian residents greater transparency and control over how businesses collect and use their personal information.

United States data protection acts include The Health Insurance Portability and Accountability Act (HIPAA), a federal law to protect sensitive patient healthcare information. The Gramm-Leach-Bliley Act (GLBA, a law applicable to financial institutions to protect confidentiality and security of consumer data . The Federal Information Security Management Act (FISMA) law to regulate federal agencies on data protection. 

Personal Data Protection Act No. 9 of Sri Lanka enacted to establish a legal framework for protecting PII in Sri Lanka.

It aims to strengthen growth and innovation in the digital economy, ensuring the protection of personal data rights, strengthen cross-border co-operation personal data protection enforcement authorities,  and 

ensuring consumer trust and safeguarding privacy. 

Therefore it requires organizations to comply to new personal data protection laws, by establishing, policies, procedures and processes for data protection compliance.

Niranjan Meegammana 


Comments

Post a Comment

Popular posts from this blog

The 7 Layers of Cyber Security : Attacks on OSI model

By
Image
Source : wallarm The OSI network  communications model is made of  7 layers. Each layer  handles a specific process to enable reliable communication between two or more devices. When the Internet was designed, its focus was on ensuring of reliable communications. The challenges of communication security emerged later.  These 7 layers act like a chain of links. If one lnk breaks, the whole chain of communication breaks. Hence security threat can happen at any of the 7 layers.  These layers are named as Application, Presentation, Session, Transport, Network, Data link and Physical layer. The application layer is your email application, physical layer is your communication cable, and everything else is in between help you communicate. In abstract the application layer provides user interface, while presentation layer handle formating, encoding and encryption. The session layer manages connections. The transport layer handles segmentation, sequencing, and establishi...
Read more

Best Practices for secure Software Development

By
Image
image : OpenSense Labs Are you aware of the  Solarwinds attack in 2020? The hackers exploited software vulnerabilities of Orion IT monitoring and management software used by thousands of enterprises and government agencies. This hack triggered a larger scale supply chain incident which affected thousands of organizations, including the U.S. government. The attackers infliltrated the Solarwinds network, and infected the software used for Network monitoring before it shipped to customers.This insident and many more warn us on the importance of building secure software.  Secure software development is a methodology used for creating robust software by incorporating security practices into every stage of the software development life cycle (SDLC). It begins at planning stage before a single line of code is written, and continue through the life cycle. A bug fixing at implementation stage cost six times than fixing it during design stage. Every new feature added, may carry series o...
Read more

ISO 27001 ISMS in a Nutshell

By
Image
Image : ISO The ISO 27001 certification is the most comprehensive  information security standard recognized globally. It ensures standardizing of your organisation's information security strategies to ensure confidentiality, integrity and availability of your systems and data to conduct your business effectively.  Gaining the certification is a journey with several milestones. It is a carefully planned systematic activity that transforms an organisation to a secure entity,  where everyone becomes a stakeholder in information security. Follow this processes to get to your goal successfully. Step 1. Obtain Management Support . This is the most critical requirement to achieve ISO 27001 status. Your ISMS project will definitely fail if it does not receive to management support. The management should provide, people, money and strategic direction for your ISMS to be a success story. In the sections below you’ll find some tips on how to convince your management, and how much th...
Read more