Personally Identifiable Information (PII)

Personally Identifiable Information is a crucial issue in the present times, as more and more aspects of our lives are being digitized and shared online. Personal data refers to any information that can identify or relate to an individual, such as name, address, phone number, email, biometrics, health records, financial transactions, etc. The protection of personal data is important for safeguarding the privacy, dignity, and autonomy of individuals, as well as for preventing misuse, theft, or harm by unauthorized parties.

What Is Personally Identifiable Information (PII)?

Personally identifiable information (PII) is any information that can reveal the identity of a person, either by itself or in combination with other information. PII can range from direct identifiers (such as passport details) that are unique to a person, to quasi-identifiers (such as race) that can identify a person when combined with other quasi-identifiers (such as date of birth).

Advanced technology has changed the way businesses, governments, and individuals operate. Digital tools like cell phones, the Internet, e-commerce, and social media have increased the availability of data. Businesses collect, analyze, and process big data, which are large and complex datasets, to gain valuable insights. This abundance of information helps companies improve their customer interactions.

However, the rise of big data also poses a threat to data security and privacy. Entities recognize the value of this information, which raises questions about how companies manage consumers’ sensitive data. Regulatory bodies are developing new laws to safeguard consumer data, while users look for more secure and private ways to use the digital world.

Sensitive vs. Non-Sensitive Personally Identifiable Information

Sensitive Personally Identifiable Information (PII) can include important details like your full name, Social Security Number (SSN), driver’s license, address, credit card, passport, and financial, and medical information. Companies that share such data often use techniques to hide or change it, so it's not directly tied to a person. For example, an insurance company might share data with a marketing firm, but the sensitive details are concealed.

Non-sensitive or indirect Personally Identifiable Information is information easily found in public sources, like zip codes, race, gender, date of birth, place of birth, and religion. Although this information alone may not identify someone, it can become identifiable when combined with other personal details. Techniques like de-anonymization can piece together different sets of quasi-identifiers, potentially revealing an individual's identity.

India’s Role in Protecting Personally Identifiable Information

India is one of the largest and fastest-growing digital markets in the world, with over 1.3 billion people and 750 million internet users. India generates a huge amount of personal data every day, through various platforms and services such as Aadhaar, e-commerce, social media, e-governance, etc. However, until recently, India did not have a comprehensive and specific law to regulate the collection, processing, storage, and transfer of personal data.

In 2017, the Supreme Court of India recognized the right to privacy as a fundamental right under the Constitution of India and highlighted the need for a robust data protection framework. In response, the government appointed a committee of experts, headed by Justice B.N. Srikrishna, to draft a data protection bill. The committee submitted its report and the draft bill, titled the Digital Personal Data Protection Act, 2023, in July 2023.

The Digital Personal Data Protection Act, 2023, is a landmark legislation that aims to balance the rights of individuals to protect their personal data with the necessity of processing such data for lawful purposes. The Act provides a set of principles, obligations, and rights for data fiduciaries (entities that collect and process personal data) and data principals (individuals whose personal data is processed). Some of the key features of the Act are:

• The Act covers personal data of Indians or processed in India by any entity.
• Requires consent for data collection and processing, except for some lawful grounds.
• Distinguishes general, sensitive, and critical personal data, with different levels of protection.
• The Act restricts and regulates the cross-border transfer of personal data, especially sensitive and critical data.
• It obliges data fiduciaries to ensure data security, conduct impact assessments, appoint officers, and report breaches.
• Grants data principals various rights to access, correct, erase, port, restrict, object, and claim compensation for their data.
• Creates a Data Protection Authority of India to monitor and enforce the Act, issue guidelines, conduct audits, and impose penalties.
• The Act penalizes serious violations of the Act with fines up to INR 250 crore or 4% of the turnover.

The Digital Personal Data Protection Act, 2023, is a significant step towards establishing a robust and comprehensive data protection regime in India, that would protect the privacy and interests of individuals, as well as foster innovation and growth in the digital economy. The Act is expected to come into force by the end of 2024 after the government notifies the rules and regulations under it. This Act would also align India with the global standards and best practices in data protection, such as the European Union’s General Data Protection Regulation (GDPR), and enable greater cooperation and trust among data-sharing partners.

FAQs

1) How to protect Personally Identifiable Information?

Protecting Personally Identifiable Information is important to safeguard individual privacy and prevent identity theft, financial fraud, and other personal risks. For organizations, mishandling PII can also lead to legal and reputational consequences.Some ways of protecting PII are:

• Use strong, unique passwords for different accounts and change them regularly.
• Be cautious about the information you share online, especially on social media and public forums.
• Use encryption, threat protection, and data-loss prevention tools to secure your devices and networks.
• Apply multi-factor authentication and biometric verification for sensitive accounts and transactions.
• Do regular security audits and updates for your software and systems.
• Train yourself and your staff on how to handle Personally Identifiable Information properly and avoid phishing and other cyberattacks.
• Restrict access to PII to only authorized and necessary personnel and limit the amount of data collected and stored.

2) What are examples of Personally Identifiable Information?

Some examples of Personally Identifiable Information (PII) are:

• Full name
• Social Security Number (SSN)
• Driver’s license number
• Passport number
• Mailing address
• Email address
• Phone number
• Login ID
• IP address
• Facial image
• Medical records
• Financial records
• Biometric data

These are data that can be used to identify, contact, or locate an individual, either directly or indirectly.