In the United States, federal privacy laws are sector-based, such as HIPAA for the health care industry or the Gramm-Leach-Bliley Act (GLBA) for the financial services industry. Businesses doing business abroad, however, must also follow local privacy laws. Whether or not a PII is personally identifiable depends on the specific risk. For more information, check out this PII compliance guide.
PII compliance is a complex ecosystem
PII compliance is an increasingly important topic in today’s world. With over half of the world’s population expected to have privacy legislation in place by 2023, businesses must take extra precautions to keep sensitive data secure. Even though non-sensitive PII like date of birth or a business phone number is not considered sensitive, it still presents a high risk. If this information is not secure, it can still be misused and used for identity theft and fraud.
PII compliance can be complex and require an integrated approach that involves implementing specific technologies and processes. In some industries, there is no single solution for PII compliance. Other sectors, such as financial services, have a multi-layered approach. For example, a leading U.S. retailer came to Snowflake with pains over processing customer data workloads. Their customer data was stacked high with PII and required patchwork privacy protection assurances. In addition, their platform was more than a decade old, so PII compliance was a problematic issue for them. The company spent a significant amount of time on the first step.
It reduces storage costs.
A critical step in ensuring compliance with PII legislation is to create policies and procedures for controlling access to sensitive data. Best practices include implementing strong encryption and secure passwords and using two-factor authentication and multifactor authentication. Other steps involve:
- Safeguarding sensitive documents and cards.
- Not dumpster diving.
- Uploading them to the cloud.
Finally, it would be best to lock down your devices when they are not in use.
PII is also known as personally identifiable information and refers to data that can identify an individual. Common forms include Social Security numbers, email addresses, and phone numbers. But PII can also include other digital identifiers, such as a fingerprint or a photo. PII compliance is an ecosystem of security and privacy with its own rules and regulations. While some data is considered sensitive and needs special protection, others are not, leading to security breaches.
It reduces risk
PII is personal information about individuals, and most consumers believe that organizations have a responsibility to protect this information. Consumers are liable for identity theft, but they can also face significant reputational damage if their data is not secure. Organizations should adopt the best data security and privacy practices to prevent these problems, including implementing a PII discovery plan and enhanced security measures for sensitive information.
The first step in ensuring PII compliance is understanding your data’s sensitivity level. Most organizational information is unstructured and, therefore, not searchable. While there are many different safeguards to protect PII, specific data may not need to be protected. For example, plumbers can list customers’ phone numbers in public directories. PII in such guides is not covered because the plumbers have consented to release it publicly. However, organizations should still implement comprehensive policies and training to minimize the risk of unauthorized access.
It requires a case-by-case assessment of the specific risk that an individual can be identified.
PII compliance requires a case-to-case assessment of the specific risk that it may discover an identifiable individual, and these assessments are frequently unclear. PII is defined as information about an individual that you could use to identify that person. Examples include email addresses, first and last names, work and home telephone numbers, and general educational credentials. Other information that is considered PII includes cookies and device IDS.
PII may also be sensitive or private, and it should carefully manage this type of information. The Department of Energy defines PII as data that could substantially harm an individual, including embarrassment, inconvenience, or unfairness. While this definition can be frustrating for IT professionals, companies must remember that it’s essential to protect consumers.
