Data Dictionary > Referenced Material > Personally identifiable information (PII)

 print | help

previousTopic:

NCIC Vehicle Color Code Values

Personally identifiable information (PII)

PII

PII is any data that could potentially identify a specific individual. The National Institute of Standards and Technology (NIST) Special Publication 800-122 defines personally identifying information as "any information about an individual maintained by an agency, including:

  1. any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date of birth, place of birth, mother's maiden name, or biometric records; and
  2. any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information." So, for example, a user's IP address is not classed as PII on its own, but is classified as a linked PII.

The following data, often used for the express purpose of distinguishing individual identity, clearly classify as personally identifiable information (under the definition used by the NIST):

  • Driver License Number
  • Social Security Number
  • Passport Number
  • Alien Registration Number
  • Bank account numbers
  • Credit card numbers

The following are less often used to distinguish individual identity, because they are traits shared by many people. However, they are potentially PII, because they may be combined with other personal information to identify an individual.

  • Full Name
  • Date Of Birth
  • Sex or Race
  • Home Address (Street, City, State, Postcode, Country)
  • Telephone Number
  • Last 4 digits of SSN
  • Web cookie

PII protection is mandated by a number of laws:

  • The U.S. Driver's Privacy Protection Act of 1994 (DPPA) (18 USC � 2725), prohibits the disclosure of personal information without the express consent of the person to whom such information applies, with the exception of certain circumstances. These rules also imposes record-keeping requirements on the "authorized recipients". Personal information means information that identifies an individual. It does not include information on vehicular accidents, driving violations, and driver’s status, but this law does classify the following data as Personal information:

  • Address (but not the 5-digit zip code)
  • Photograph (Digital Image)
  • Medical information
  • Disability information
  • The U.S. Privacy Act of 1974 (Pub. L. 93–579, 88 Stat. 1896, 5 USC � 552a), establishes a Code of Fair Information Practice that governs the collection, maintenance, use, and dissemination of personally identifiable information about individuals that is maintained in systems of records by federal agencies.
  • The U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) (45 CFR 160 and 45 CFR 164), includes provisions to protect a patient's Protected Health Information (PHI), which is similar to PII.
  • Title 18 USC � 1028d(7) specifies rules about fraud and related activity in connection with identification documents (which contain PII), authentication features, and information.
  • The U.S. Freedom of Information Act (FOIA), (5 USC � 552) grants public access to government records. However the law contains a clause which excludes information that is prohibited from disclosure by another federal law, so the U.S. laws listed above take precedence over FOIA on the protection of PII.
  • California:
    • The California state constitution declares privacy an inalienable right in Article 1, Section 1.
    • California Online Privacy Protection Act (OPPA) of 2003 has requirements for commercial websites handling PII, to include a privacy policy.
    • California SB 1386 requires organizations to notify individuals when PII (in combination with one or more additional, specific data elements) is known or believed to be acquired by an unauthorized person.
    • The California State Supreme Court in 2011, ruled that a person's ZIP code is PII.
  • Massachusetts:
    • Massachusetts 201 CMR 17.00: Standards for The Protection of Personal Information of Residents of the Commonwealth.
    • The Massachusetts Supreme Court in 2013 ruled that ZIP codes are PII.
  • Nevada: Nevada Revised Statutes 603A-Security of Personal Information.
  • The U.S. Senate has proposed but not yet passed a number of additional laws relating to PII and public concern could lead to other new legislation. It is important to monitor new federal and state legislation.

When data is stored or exchanged, PII can be classified as sensitive or non-sensitive.

  • Sensitive PII is information which, when disclosed, could result in harm to the individual whose privacy has been breached. It is recommended that sensitive PII should be encrypted in transit and when data is at rest. Such information includes unique identifiers (such as license, passport or Social Security numbers), a combination of fields that identify a person, biometric information, medical information and/or personally identifiable financial information (PIFI),
  • Non-sensitive PII has a lower level of requirements for protection, as its release would not result in harm to the individual. Non-sensitive PII can be easily gathered from public records, phone books, corporate directories and websites.

nextTopic:

Unit of Measure

previousTopic:

NCIC Vehicle Color Code Values

Printable Characters

All text data elements in the payload of a data exchange must limit the characters to the "printable characters" that can be supported by all parties. This means that non-printable bytes and non-English letters are not allowed in any message. The printable characters which are common to all parties are:

  • space
  • a to z
  • A to Z
  • 0 to 9
  • ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ \ _ ` { | } ~

Other characters must be excluded because they are not common to all encoding schemes (ASCII, UTF-8 and EBCDIC) used by various parties. The other characters can be dropped or substituted with a similar letter from the English alphabet. The table below describes these letter transliterations (i.e. the Spanish enye character (an "N" with a "~" above it ("�")) is converted to the English letter "N").

  • Some elements (such as a person name), call for the letters to be transliterated.
  • For other elements, the users can determine if it would be more meaningful for the non-printable characters to be omitted or substituted for another character.

(Note: extended word processor characters like a "non-breaking space" must not be used, only the default characters are common to all encoding schemes and can be exchanged).

Character

Transliteration

Description

 

Character

Transliteration

Description

�

A

A acute

 

N

N

N acute

�

A

A grave

 

�

N

N tilde or enye

�

A

A circumflex

 

N

N

N caron

�

AE

A diaeresis

 

N

N

N cedilla

�

A

A tilde

 

?

N

Eng

A

A

A breve

 

�

OE

O slash

�

AA

A ring

 

�

O

O acute

A

A

A macron

 

�

O

O grave

A

A

A ogonek

 

�

O

O circumflex

C

C

C acute

 

�

OE

O diaeresis

C

C

C circumflex

 

�

O

O tilde

C

C

C caron

 

O

O

O double acute

C

C

C dot accent

 

O

O

O macron

�

C

C cedilla

 

O

O

O breve

�

D

Eth

 

R

R

R acute

D

D

D caron

 

R

R

R caron

�

E

E acute

 

R

R

R cedilla

�

E

E grave

 

S

S

S acute

�

E

E circumflex

 

S

S

S circumflex

�

E

E diaeresis

 

�

S

S caron

E

E

E caron

 

S

S

S cedilla

E

E

E dot accent

 

T

T

T bar

E

E

E macron

 

T

T

T caron

E

E

E ogonek

 

T

T

T cedilla

E

E

E breve

 

�

U

U acute

G

G

G circumflex

 

�

U

U grave

G

G

G breve

 

�

U

U circumflex

G

G

G dot accent

 

�

UE

U diaeresis

G

G

G cedilla

 

U

U

U tilde

H

H

H bar

 

U

U

U breve

H

H

H circumflex

 

U

U

U double acute

I

I

I without dot (Turkey)

 

U

U

U ring

�

I

I acute

 

U

U

U macron

�

I

I grave

 

U

U

U ogonek

�

I

I circumflex

 

W

W

W circumflex

�

I

I diaeresis

 

�

Y

Y acute

I

I

I tilde

 

Y

Y

Y circumflex

I

I

I dot accent

 

�

Y

Y diaeresis

I

I

I macron

 

Z

Z

Z acute

I

I

I ogonek

 

�

Z

Z caron

I

I

I breve

 

Z

Z

Z dot

J

J

J circumflex

 

�

TH

Thorn (Iceland)

K

K

K cedilla

 

�

AE

ligature AE

L

L

L slash

 

?

IJ

ligature IJ

L

L

L acute

 

�

OE

ligature OE

L

L

L caron

 

�

SS

double s (Germany)

L

L

L cedilla

 

?

' (apostrophe)

?okina (glottal stop)

?

L

L dot

 

 

 

 

(Note: this table is based on information in the ICAO 9303 Machine Readable Travel Documents standard).

Background Information: IBM mainframes mostly hold character data in EBCDIC, while UNIX, Unisys, Windows and most other computer types store character data in an ASCII or a similar format. Data transmitted by AAMVA is in ASCII format. So when an EBCDIC site is sending or receiving data, it converts the characters to and from ASCII. The translation occurs by replacing a bit pattern from one code set with the corresponding bit pattern from the other code set. The translation is performed on each byte of data traveling on the data path without regard to the content of the data. As non-printable characters may not have corresponding characters in the other encoding scheme, this data would be corrupted when the bit patterns were translated, hence the "printable character" rule.

nextTopic:

Unit of Measure
topOfPage print | help