Record Example

Term: sensitive personally identifiable information

Definition: A category of Personal Identifiable Information (PII) that, if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. SPII can exist in various forms: Stand-alone SPII: Includes Social Security Numbers (SSN), driver’s license or state identification number, Alien Registration Numbers, financial account numbers, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Grouped SPII: Information that contains an individual’s name or other unique identifier plus one or more of the following elements: Truncated SSN (such as last four digits) Date of birth (month, day, and year) Citizenship or immigration status Ethnic or religious affiliation Sexual orientation Criminal history Medical information System authentication information such as mother’s maiden name, account passwords, or personal identification numbers Context-dependent SPII: Other PII that may be considered “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not considered sensitive.