personally identifiable information (PII) (noun) [Word Notes]

Summary

Podcast Summary: Hacking Humans - Episode on Personally Identifiable Information (PII)

Podcast Information:

• Title: Hacking Humans
• Host/Author: N2K Networks
• Description: Deception, influence, and social engineering in the world of cybercrime.
• Episode: Personally Identifiable Information (PII) [Word Notes]
• Release Date: November 19, 2024

---

Introduction to Personally Identifiable Information (PII)

In this episode of Hacking Humans, hosted by Rick Howard and produced by N2K Networks, the focus is on Personally Identifiable Information (PII)—a critical concept in the realms of cybersecurity and data privacy. PII encompasses any data that can be used to identify, contact, or locate an individual, either directly or indirectly. Understanding PII is paramount for organizations to protect individuals' privacy and comply with various legal frameworks.

Defining PII

Rick Howard begins by breaking down the acronym PII: "P for personally, I for identifiable, and I for information." He elaborates:

Rick Howard [00:52]: "The word is pii spelled P for personally, I for identifiable, and I for information. Definition A term of legal art that defines the types of data and circumstances that permits a third party to directly or indirectly identify an individual with collected data."

This precise definition underscores the legal and ethical responsibilities organizations bear in handling such information.

Historical Context and Evolution of PII

Howard delves into the historical evolution of the concept of privacy and PII:

• 19th Century Origins: The notion of privacy as a legal consideration dates back to the late 19th century. According to Paul Schwartz and Daniel Solow from the University of California, Berkeley School of Law, the foundational ideas were laid by Samuel Warren and Louis Brandes in 1892. They framed privacy in the context of European philosophy, asserting that every individual deserves protection against certain human-induced harms.

• 1974 - Family Educational Rights and Privacy Act (FERPA): The United States took a significant step by passing FERPA, which, while focusing on educational records, introduced the term PII into legal vernacular. However, FERPA did not provide a comprehensive definition of PII, limiting its scope to educational contexts.

• 1984 - Cable Communications Policy Act: This act further refined the legal landscape by explicitly referencing PII. It prohibited cable operators from collecting PII from individual subscribers without consent, although it allowed the collection of aggregate data for statistical purposes.

• 1996 - Health Insurance Portability and Accountability Act (HIPAA): HIPAA provided a more detailed definition of PII, listing specific data elements such as full name, date of birth, Social Security number, among others. It identified 21 elements that constitute PII, with the possibility of expanding this list when combined in specific ways (e.g., first name, place of birth, height, and weight).

Rick Howard [00:52]: "Origin and Context the idea of privacy in terms of legal considerations has been around since the late 19th century..."

The GDPR Revolution

A significant shift in data protection paradigms was marked by the General Data Protection Regulation (GDPR) enacted by the European Union in March 2020. Unlike earlier US-centric definitions, GDPR adopts the broader term "data protection" instead of PII, reflecting a more expansive view of personal information.

Rick Howard [00:52]: "The GDPR regulation swaps out the term PII for the preferred phrase data protection, since PII is a US created term of art."

Key aspects of GDPR include:

• Broad Definition: Any information relating to a specific individual, irrespective of its nature (private, public, or professional), is protected.
• Individual Rights: GDPR empowers individuals with rights to request deletion of their data, correct inaccuracies, and obtain copies of their personal information.
• Compliance and Penalties: Organizations failing to adhere to GDPR can face substantial fines, emphasizing the regulation's enforceability.

The Rise of CCPA and State-Level Legislation

Following GDPR's comprehensive framework, the United States saw the introduction of the California Consumer Privacy Act (CCPA) in 2018, which became effective in 2020. CCPA mirrors GDPR in scope, granting California residents similar rights concerning their personal data.

Rick Howard [00:52]: "In 2018, the US state of California passed the California Consumer Privacy act, or CCPA, that is similar in scope to GDPR."

Moreover, as of 2020, five other states—Washington, Nebraska, Virginia, Florida, and New York—are actively pursuing legislation akin to GDPR, indicating a growing trend towards stringent data protection laws across the United States.

Pop Culture Illustration: Privacy Invasion in "Parks and Recreation"

To illustrate the practical implications of PII and privacy concerns, the episode references a memorable scene from the American TV show "Parks and Recreation."

Ron Swanson [04:57]: "Listen, I was trying to buy this handcrafted mahogany wood model of a B25 Mitchell Panchito aircraft. Aw, for me, don't sass me. And I went to this website and this ad popped up that said, hey Ron Swanson, check out this great offer."

In this scene, Ron Swanson, portrayed by Nick Offerman, confronts April Ludgate (Aubrey Plaza) about an advertisement that seemingly knows his name, highlighting the invasive nature of data collection practices like tracking via cookies.

April Ludgate [05:16]: "Like, how do they know who you are? Yeah, okay, there are these things called cookies where, like if you go to a site and buy something, it'll remember you and then create ads for other stuff you might want to buy."

This dialogue emphasizes how seemingly benign technologies can erode personal privacy, making individuals aware of how their PII is harvested and utilized for targeted advertising.

Insights and Implications

The episode underscores the evolving landscape of data privacy, highlighting the transition from localized, sector-specific regulations to comprehensive, cross-jurisdictional frameworks like GDPR and CCPA. Key takeaways include:

• Increased Consumer Awareness: There is a growing demand among consumers to understand what PII companies collect and how it's used. This is evident from regulatory pressures pushing for transparency and control.

• Organizational Responsibility: Businesses must not only safeguard PII against breaches but also ensure compliance with diverse legal standards to avoid hefty penalties.

• Technological Advancements and Risks: As technological innovations expand the avenues through which data is collected and processed, so do the risks associated with data exposure and misuse.

Conclusion

"Hacking Humans" provides a comprehensive overview of Personally Identifiable Information, tracing its historical roots, legal definitions, and the modern regulatory environment that governs its protection. By weaving in real-world examples and pop culture references, the episode makes the complex topic accessible and relevant, emphasizing the critical importance of data privacy in today's interconnected world.

---

Notable Quotes:

• Rick Howard [00:52]: "The word is pii spelled P for personally, I for identifiable, and I for information."

• Ron Swanson [04:57]: "Listen, I was trying to buy this handcrafted mahogany wood model of a B25 Mitchell Panchito aircraft..."

• April Ludgate [05:16]: "Like, how do they know who you are? Yeah, okay, there are these things called cookies where, like if you go to a site and buy something, it'll remember you and then create ads for other stuff you might want to buy."

---

Credits:

• Word Notes: Written by Nyla Genoi
• Executive Produced by: Peter Kilpie
• Edited by: John Petrick and Rick Howard
• Mix, Sound, Design, and Original Music: Elliot Peltzman

Thank you for listening to "Hacking Humans" powered by N2K Networks.

Transcript

[Rick Howard]

You're listening to the Cyberwire Network powered by N2K.

[Peter Kilpie]

The IT world used to be simpler. You only had to secure and manage environments that you controlled. Then came new technologies and new ways to work. Now employees, apps and networks are everywhere. This means poor visibility, security gaps and added risk. That's why Cloudflare created the first ever connectivity cloud. Visit cloudflare.com to protect your business everywhere you do business.

[Rick Howard]

The word is pii spelled P for personally, I for identifiable, and I for information. Definition A term of legal art that defines the types of data and circumstances that permits a third party to directly or indirectly identify an individual with collected data. Example sentence Regulators understand that there is a growing demand among consumers to know all the PII that companies have about them, backed up with the right to view and possibly correct this data. Origin and Context the idea of privacy in terms of legal considerations has been around since the late 19th century, according to Paul Schwartz and Daniel Solow from the University of California, Berkeley School of law. In 1892, lawyers Samuel Warren and Louis Brandes wrote the original paper that framed privacy in terms of European philosophy and said that every person deserves protection against certain kinds of harms as a consequence of being human. For digital privacy, the world didn't get a legal definition of PII until 1974. The United States or US passed the Family Educational Rights and Privacy act, or FERPA, but the law focused on educational records and not a precise definition of what makes up PII. In 1984, the US passed the cable Communications Policy act that not only refers to pii but makes it the trigger for the applicability of the law. It prohibits a cable operator from collecting PII concerning any individual subscriber without consent. It didn't prohibit the collection of aggregate information, though that means the cable operators could collect PII for statistical purposes. By 1996, the US passed the Health Insurance Portability and Accountability act and defined precisely the data elements within PII full name, date of birth, Social Security number, etc. About 21 elements in total, plus other elements if combined in the right way, like first name, place of birth, height and weight, etc. Fast forward to 2016. The European Union or EU passed the General Data Protection Regulation, or GDPR, according to RSI Security, in March of 2020. The GDPR regulation swaps out the term PII for the preferred phrase data protection, since PII is a US created term of art. In doing so, though, the EU greatly expanded the common notion of what data elements make up personal information. The law states that Any information that relates to a specific individual, whether that data is private, public or professional in is protected under gdpr. It also gave power to the individual by authorizing deletion requests, error correction, and requests for copies. Organizations that fail to comply with these individual requests are subject to heavy fines. In 2018, the US state of California passed the California Consumer Privacy act, or CCPA, that is similar in scope to GDPR. As of 2020, according to the International Lawyers Network, five other states are trying to pass similar GDPR legisl Washington State, Nebraska, Virginia, Florida, and New York. Nerd Reference on the American TV show Parks and Recreation, Ron, played by Nick Offerman, calls April, played by Aubrey Plaza, into his office to ask how a website could possibly know his name.

[Ron Swanson]

Listen, I was trying to buy this handcrafted mahogany wood model of a B25 Mitchell Panchito aircraft. Aw, for me, don't sass me. And I went to this website and this ad popped up that said, hey Ron Swanson, check out this great offer.

[April Ludgate]

What's your question?

[Ron Swanson]

My question is, what the hell?

[April Ludgate]

Like, how do they know who you are? Yeah, okay, there are these things called cookies where, like if you go to a site and buy something, it'll remember you and then create ads for other stuff you might want to buy.

[Ron Swanson]

So it learns information about me. Seems like an invasion of privacy, dude.

[April Ludgate]

If you think that's bad, go to Google Earth and type in your address.

[Rick Howard]

That noise you hear at the end is Ron marching his brand new computer down to the dumpster. Credits wordnotes is written by Nyla Genoi, executive produced by Peter Kilpie and edited by John Petrick and me, Rick Howard. The mix, sound, design, and original music have all been crafted by the ridiculously talented Elliot Peltzman. And thanks for listening.

[Peter Kilpie]

And now a word from our sponsor, NordPass. NordPass is an advanced password manager from the team behind NordVPN, designed to help keep your business safe from data leaks and cyber threats. It gives your IT professionals control over who has access to your company's data and makes it easy for everyone else on your team to use strong passwords. Right now you can go to www.nordpass.com cyberwire for 35% off the NordPass business yearly plan. Don't miss out on that.