It’s important to learn about personally identifiable information (PII) because of how it relates to data privacy. Identifiable information can be used for illegal purposes like identity theft and fraud.
So how can you protect yourself as an innocent web browser?
Or, if you’re a website owner – how do you protect users and your company from falling prey to privacy breaches?
As one of the most trusted analytics companies, we feel our readers would benefit from being as informed as possible about data privacy issues and PII. Learn how you can keep yours or others’ information safe.
Table of Contents
What does PII stand for?
‘PII’ is an acronym for personally identifiable information.
Personally identifiable information (PII) is defined as any information that can be used to identify a person’s identity. It’s a term primarily used in the US.
The appendix of OMB M-10-23 (Guidance for Agency Use of Third-Party Website and Applications) gives an official definition for PII:
What can be considered personally identifiable information (PII)? Some PII examples:
- Full name/usernames
- Home address/mailing address
- Email address
- Credit card numbers
- Date of birth
- Phone numbers
- Login details
Who is affected by the exploitation of PII?
Anyone can be affected by the misuse of personal data. Websites can compromise your privacy by mishandling or illegally selling/sharing your data. This may lead to identity theft, account fraud and account takeovers. The fear is falling victim to such fraudulent activity.
PII can also be an issue when employees can access databases where the data is not encrypted. For example, anyone working in a bank can access your accounts; and anyone working at Facebook can read your messages. This shows how privacy breaches can easily happen when employees have access to PII.
Website owner’s responsibility for data privacy (PII and analytics)
If you’re using a web analytics tool like Google Analytics or Matomo, best practise is to not collect PII if possible. This is to better respect your website visitor’s privacy.
If you work in an industry which needs people to share personal information (e.g. healthcare, security industries, public sector), then you must collect and handle this data securely.
The US National Institute of Standards and Technology states: “The likelihood of harm caused by a breach involving PII is greatly reduced if an organisation minimises the amount of PII it uses, collects, and stores. For example, an organisation should only request PII in a new form if the PII is absolutely necessary.”
How you’re held accountable remains up to the privacy laws of the country you’re doing business in. Make sure you are fully aware of these privacy and data protection laws that relate specifically to you.
To reduce the risk of privacy breaches, try collecting as little PII as you can; purging it as soon as you can; and making sure your IT security is updated and protected against security threats.
With data collection tools like web analytics, data may be tracked through features like User ID, custom variables, and custom dimensions. Sometimes they are also harder to identify when they are present, for example, in page URLs, page titles, or referrers URLs. So make sure you’re optimising your web analytics tools’ settings to ensure you’re asking your users for consent and respecting users’ privacy.
PII, GDPR and businesses in the US/EU
You may get confused when considering PII and GDPR (which applies in the EU). The General Data Protection Regulation (GDPR) gives people in the EU more rights over “personal data” – which covers more identifiers than PII (more on PII vs personal data below). GDPR restricts the collection and processing of personal data so businesses need to handle this personal data carefully.
According to the GDPR, you can be fined up to 4% of their yearly revenue for data/privacy breaches or non-compliance.
In the US, there isn’t one overarching data protection law, but there are hundreds of laws on both the federal and state levels to protect PII of US residents. US Congress has enacted industry-specific statutes related to data privacy like HIPAA. Recently state of California also passed the California Consumer Privacy Act (CCPA).
To be on the safe side, if you’re using analytics, follow matters relating to “personal data” in the GDPR. It covers more when it comes to protecting user privacy. GDPR rules still apply whenever an EU citizen visits any non EU site (that processes personal data).
Personally identifiable information (PII) vs personal data
This means « personal data » covers more identifiers, including online identifiers. Examples include: IP addresses and URL names. As well as seemingly “innocent” data like height, job position, company etc.
What’s seen as personal data depends on the context. If a piece of information can be combined with others to establish someone’s identity then that can be considered personal data.
Under GDPR, when processing personal data, you need explicit consent. So best to be compliant according to GDPR definitions of “personal data” not just what’s considered “PII”.
How do you keep PII safe?
- Try not to give your data away so easily. Read through terms and conditions.
- Don’t just click ‘agree’ when faced with consent screens, as consent screens are majorly flawed.
- Disable third party cookies by default.
- Use strong passwords.
- Be wary of public wifi – hackers can easily access your PII or sensitive data. Use a VPN (virtual private network)
- Read more on how to keep PII safe. For businesses here’s a checklist on PII compliance.
How Matomo Analytics deals with PII and personal data
Although Matomo Analytics is a web analytics tool that tracks user activity on your website, we take privacy and PII very seriously – on both our Cloud and On-Premise offerings.
If you’re using Matomo and would like to know how you can be fully GDPR compliant and protect user privacy, read more:
- Learn how to not process any personally identifiable information – Anonymise IP addresses, user IDs, and order IDs
- Matomo protects user privacy by talking the talk and walking the walk
- Stay ahead of the GDPR with a privacy-respecting analytics platform
- 11 ways Matomo helps you protect your visitor’s privacy
We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to issues you may encounter when dealing with PII. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns.