Protecting Personal Identifiable Information (PII)

By Elliott Lowen, Chief Privacy Officer, Data Safeguard Inc.

Personally identifiable information (PII) is any information that can be used to identify an individual, such as their name, address, Social Security number, or date of birth. PII is often collected and stored by businesses, government agencies, and other organizations.  Even secured, PII can be stolen and used unscrupulously.  The best way to protect PII is to redact it – remove it – by using enterprise level software, such as Data Safeguard’s ID-REDACT.

In recent years, there has been a growing awareness of the importance of protecting PII. This is due in part to the increasing number of data breaches, which have exposed the PII of millions of people. In addition, there have been several high-profile cases in which PII has been used for identity theft and other crimes.

As a result of these concerns, there has been a growing emphasis on PII protection. Governments have enacted new laws and regulations, and businesses have implemented new security measures. However, there is still more that needs to be done to protect PII.

There are several laws and regulations that govern the protection of PII. These laws vary from country to country, but they typically include requirements for businesses to collect, store, and use PII in a secure manner.

In the United States, the most important law governing health care protection, PHI, is the Health Insurance Portability and Accountability Act (HIPAA). HIPAA sets forth several requirements for healthcare organizations that collect and store PII. These requirements include:

● Obtaining patient consent before collecting PII

● Using PII only for authorized purposes

● Securing PII against unauthorized access, use, or disclosure

There are several state-based privacy initiatives in the United States. Some of the most notable include:

● California Consumer Privacy Act (CCPA): The CCPA is the first comprehensive privacy law in the United States. It gives consumers control over their personal information and requires businesses to be transparent about how they collect and use data.

● Colorado Privacy Act (CPA): The CPA is like the CCPA, but it has some additional provisions, such as requiring businesses to obtain consent before selling personal information.

● Connecticut Personal Data Privacy and Online Monitoring Act (CPDPA): The CPDPA is like the CCPA, but it has some additional provisions, such as requiring businesses to provide consumers with a copy of their personal information and to allow consumers to opt out of targeted advertising.

● Indiana Consumer Data Protection Act (ICPDA): The ICPDA is like the CCPA, but it has some additional provisions, such as requiring businesses to provide consumers with a copy of their personal information and to allow consumers to opt out of targeted advertising.

● Iowa Consumer Data Protection Act (ICDPA): The ICDPA is like the CCPA, but it has some additional provisions, such as requiring businesses to obtain consent before selling personal information and to allow consumers to opt out of targeted advertising.

● Montana Consumer Data Privacy Act (MCDPA): The MCDPA is like the CCPA, but it has some additional provisions, such as requiring businesses to provide consumers with a copy of their personal information and to allow consumers to opt out of targeted advertising.

● Tennessee Information Protection Act (TIPA): The TIPA is like the CCPA, but it has some additional provisions, such as requiring businesses to obtain consent before selling personal information and to allow consumers to opt out of targeted advertising.

● Texas Data Privacy and Security Act (TDPSA): The TDPSA is like the CCPA, but it has some additional provisions, such as requiring businesses to obtain consent before selling personal information and to allow consumers to opt out of targeted advertising.

● Utah Consumer Privacy Act (UCPA): The UCPA is like the CCPA, but it has some additional provisions, such as requiring businesses to obtain consent before selling personal information and to allow consumers to opt out of targeted advertising.

● Virginia Consumer Data Protection Act (VCDPA): The VCDPA is like the CCPA, but it has some additional provisions, such as requiring businesses to obtain consent before selling personal information and to allow consumers to opt out of targeted advertising.

The European Union has also enacted several laws governing the protection of PII. These laws include the General Data Protection Regulation (GDPR), which is the most comprehensive PII protection law in the world. The GDPR applies to all businesses that process the PII of individuals in the European Union.

Despite the existence of laws and regulations, PII breaches continue to occur. In 2022, there were over 100,000 data breaches reported, exposing the PII of millions of people.

The most common cause of PII breaches is human error. This can include employees accidentally mishandling PII or falling victim to phishing attacks. Other causes of PII breaches include:

● System vulnerabilities

● Malicious attacks

● Natural disasters

In our opinion, there is no better way to protect PII from breaches than redact it, using tools like Data Safeguard’s ID-REDACT.

Outside of the US, Government agencies in many countries have responsibilities for enforcing PII protection laws and regulations. In the United States, the Federal Trade Commission (FTC) is the primary regulator of PII protection. The FTC has the authority to investigate and act against businesses that violate PII protection laws.

Other PII regulators include:

● The European Data Protection Board (EDPB)

● The Australian Privacy Commissioner (OPC)

● The Canadian Privacy Commissioner (OPC)

The protection of PII is an important issue that businesses and governments need to take seriously. PII breaches can have a devastating impact on individuals, and they can also damage the reputation of businesses.

There are several things that businesses can do to protect PII, including:

● Implement a program like Datasafeguard’s ID-REDACT to protect PII by removing it.

● Implementing strong security throughout the enterprise

● Training employees on PII protection

● Conducting regular risk assessments