32

A public website of a financial firm (falls under SEC) has a HTML 5 map of the US where each point on the map is the 5 digit zip code of their clients. These points are generated from a CSV file that is pulled from the server into the browser so you can actually download the CSV file yourself. The CSV file contains the City, Zip, and Latitude/Longitude of the zip code itself, not the client's street address.

I was wondering, are zip codes alone considered personal identifying information?

Improve this question
5
  • 6
    Considered that by whom?
    – Neil Smithline
    Commented Dec 31, 2015 at 18:12
  • 9
    I don't know if it affects the answer, but: 5-digit zip, or zip+4 (accurate down to a street)? And are lat/lon some center point of the zip code or the clients' precise locations?
    – user15392
    Commented Dec 31, 2015 at 18:29
  • 1
    Thanks, I made the question clearer. Is not the client's precise location. I guess PID considered by a security auditor or SEC auditors where the firm can be fined for exposing client information publicly.
    – cflyer
    Commented Dec 31, 2015 at 19:30
  • 9
    Carpetflyer, it all depends on the context. A list of the ZIP codes of your clients is not personally identifying them. But a ZIP code along with any other information, such as "ZIP 55555 : 10000 dollars to Zurich bank on 12/12/2015" could be identifying, especially in a database full of related transactions.
    – John Deters
    Commented Dec 31, 2015 at 20:51
  • 2
    Your revision still doesn't address whether you mean 5-digit ZIP code or ZIP+4. That will have a significant effect on the answer. Consider: there are roughly 10^8 people in the US; 10^5 different 5-digit ZIP codes; potentially 10^9 different ZIP+4 codes. Hopefully you can see how this leads to a very different answer, and thus is critical to include in the information.
    – D.W.
    Commented Jan 1, 2016 at 22:44

6 Answers 6

Reset to default
59

Netflix once planned to have a contest (to improve movie recommendations) where they would release movie rental history, movie reviews along their birth dates, gender, and five-digit zip code. That combination is personally identifying information and could do things like out someone's private sexual identity if that could be inferred from their rental history.

A famous study found that with the date of birth, gender, and five-digit zip code you can uniquely identify about 87% of Americans. It also found that you could uniquely identify about 100,000 Americans (0.04%) by the combination of year of birth, gender, and zip code.

For medical de-identification of protected health information (PHI), the US Dept of Health and Human Services suggests to truncate the last two digits of the five-digit zip code off, except for 17 rare zip codes starters (where less than 20,000 people share these three initial digits according to the US Census) (specifically 036, 059, 063, 102, 203, 556, 692, 790, 821, 823, 830, 831, 878, 879, 884, 890, 893) in which case you should replace the zip code with all zeros.

Similarly, you should be mindful of fields like age in exceptional cases are rare (e.g., there's only one American with an age of 116) so HHS recommends grouping these exceptional ages into one category (e.g., 90+). It's also probably better to group other users into age categories (like 50-55) to help anonymize them further.

Improve this answer
6
  • The text around the study you link to says date of birth in the first example and year of birth in the second. Does this mean that 2016.01.01 is needed in the first case and only 2016 in the second?
    – user30204
    Commented Jan 1, 2016 at 13:35
  • 1
    @MichaelT the second is Experiment D in the paper. The study actually uses age, and then, since age can correspond to two possible years of birth, uses the date of admission to determine the year of birth. Other experiments use only the age, and thus use a two-year range for year of birth.
    – muru
    Commented Jan 1, 2016 at 23:47
  • 4
    I'm surprised at the high number of upvotes to an answer that does not specifically address the question I was wondering, are zip codes alone considered personal identifying information?
    – user13695
    Commented Jan 2, 2016 at 15:44
  • 1
    I didn't directly answer it, because like many questions its not a simple yes/no. If your health care provider mails you a letter and your zip code is showing on the outside of an envelope to your mail carrier, is that a privacy breach? Obviously it would be if they printed your SSN, date of birth, credit card number on the envelope it would be. Or if only one family resides in a zip code and you are listed as a customer your privacy was violated (though this rare case happens for about 0.00001% of Americans), so it would break HIPAA to publicly state someone from 30334 had illness X.
    – dr jimbob
    Commented Jan 2, 2016 at 16:49
  • 1
    k-anonymity, l-diversity, and t-closeness are interesting theoretical concepts for OP to look up, which in and of themselves explain why the 116 was lumped in with 90+, and why the common zip codes were thrown out.
    – Millie Smith
    Commented Jan 2, 2016 at 21:22
19

By itself, no. You can't identify an individual by just knowing that persons zipcode. Zipcode is merely demographic information.

But, you might be able to combine a large number of individual pieces of demographics to identify someone. Zipcode + Age + Sex + Income might easily be enough to identify someone. If I told you that Person A was male, 60 years old, lived in zip code 98039, and had an income of 2 billion dollars last year, you might guess I was talking about Bill Gates. (I have no idea how much Bill made last year, but I'm trying to illustrate a point).

The point being that the aggregate of individually non-PII demographic information can itself become PII.

Improve this answer
7
  • 1
    Apparently I upvoted this a while back, but I'm really not sure why, as it's false on its face: there're plenty of people and business entities uniquely identifiable by zipcode alone, so it's clearly PII even "by itself", let alone in combination with the additional metadata (approximate date of addition, that they can and do invest in that company, etc) that the map provides.
    – Dewi Morgan
    Commented Jul 12, 2018 at 14:39
  • @DewiMorgan Zip+4, possibly. Maybe for a PO box that's true, but AFAIK there's no individual that specifically has their own 5 digit ZIP code, which is what the question specifically mentions, not zip+4. Despite what Mitt Romney says, corporations aren't people.
    – Steve Sether
    Commented Sep 18, 2019 at 21:31
  • localistica.com/usa/zipcodes/least-populated-zipcodes Several single-person zipcodes, many more of a single family. Zipcodes are not allocated by population.
    – Dewi Morgan
    Commented Sep 19, 2019 at 14:30
  • I think the reason I upvoted was that, even though the point about zipcodes doesn't hold for some tiny fraction of the population, I do strongly agree with your conclusion (aggregate data can become PII), and I feel far too few people are aware of that critical point, which you made well.
    – Dewi Morgan
    Commented Sep 19, 2019 at 14:33
  • @DewiMorgan That website you're pointing to is just wrong for the population of the zipcode. If you click on the link for the zipcode, it takes you to a page with a different population estimate of around 30-100 people. This is confirmed if you go to the census website and enter in one of the zipcodes. Census data is the source of the information. factfinder.census.gov/faces/nav/jsf/pages/community_facts.xhtml
    – Steve Sether
    Commented Sep 19, 2019 at 14:50
10

Yes, of course it is personally identifying information. It provides identifying information about a person, so why on earth might it be considered otherwise?

Consider a shopkeeper in a small town saying "I think I shall invest in [very unpopular company] when I get home tonight." His customer says "if you do, I will never shop here again!" That night, the customer sees that another investor appears on the company's map for that zipcode.

Would you consider it unreasonable of the customer to stop shopping at that store? Would you consider it unreasonable of others, on hearing this tale, to also stop shopping there? Remember, small town, there probably weren't any investors at all from there before.

Would you consider it reasonable of the shopkeeper to then sue the company for leaking his private investment information and hence causing damage to his business?

So the potential number of zipcodes where the combination of [is a user of that webside's service] and [lives in that zipcode] and [when they started investing] will be uniquely identifying is obviously pretty huge.

But it's worse than that.

The following zipcodes have a population of exactly one person: 05141, 67843, 88264, 98222, 99790. There are over a hundred zipcodes with populations under 10. 11109 has an area of just two city blocks. If you live in 38639 you are also black. If you live in 02562 you are white (better than 99% probability for both). If you live in Beverly Hills 90210, you are rich and everyone knows it. If you live in 90209, you are still rich, but likely have a chip on your shoulder about your zipcode being less famous.

There are a little under 8 billion of us. That means that we need only "33 bits of entropy" -- that is, 33 yes/no questions which slice the population roughly in half, like "are you male", "do you live outside China/India", etc -- to identify any individual. A zipcode provides between 16 bits of information (the two most populous zipcodes have over 110,000 people in) and the full 33 (those 6 zipcodes above). That is to say, a zipcode alone is at least half the information needed to uniquely identify anybody.

[Edit: and of course, in the US, businesses are persons. Many, MANY companies with a technical population of zero have their own zipcodes. If that company invests in another company, they may well NOT like that information being put up publicly.]

[Edit2: Zip codes are explicitly called out as PII by Massachusetts (https://casetext.com/case/tyler-v-michaels-stores) and California (http://scocal.stanford.edu/opinion/pineda-v-williams-sonoma-33947).]

Improve this answer
12
  • 7
    Your first line is too strong for the context. It can be enough to identify a single individual.
    – schroeder ♦
    Commented Dec 31, 2015 at 22:03
  • 3
    @schroeder Not at all, I should have stated it more strongly if anything: it's an extremely basic fact which needs driving home. I restrained myself only because people seem to listen better to understatement. Being uniquely identifying for all possible values is not a prerequisite for PII. In fact, I am finding it challenging to think up a single piece of identifying information which is in all cases uniquely identifying. SSNs obviously fail this test, so what passes it?
    – Dewi Morgan
    Commented Dec 31, 2015 at 22:21
  • 3
    You seem sure that it is a basic fact, but I don't think you have stated your case well.
    – schroeder ♦
    Commented Dec 31, 2015 at 22:35
  • 2
    @DewMorgan ssn does pass the test - en.wikipedia.org/wiki/Social_Security_number#Purpose_and_use - which IMO strengthens your point. We wouldn't say ssn is not PII just because the social security administration messed up and assigned the same number twice.
    – emory
    Commented Jan 1, 2016 at 1:55
  • 1
    @DavidRicherby: Generally, PII is considered in terms of globally unique identification, but you're right that there are cases where we can say "everyone outside the US is irrelevant" (eg, if we knew all investors are in the US). Then you need only a shade over 29 bits to uniquely identify, of which zipcodes provide between 12 and 29 bits.
    – Dewi Morgan
    Commented Jan 3, 2016 at 20:57
5

In The Netherlands both CPB (government institution for statistics) and CBP (government watchdog for privacy both in the commercial as government domain) will conclude that the dataset you have is containing personal identifying information. Their reasoning will be as followed most likely:

  1. A zip-code can identify say <100 people with it's strongest match and can identify <2500 people with the suffix removed (removing the last two characters from the six positions). The first four identify the region on the map and the last two the subregion that will even identify which of the street it is in some cases;
  2. As you only list customers any hit will identify the customer in that area indirectly unless you're the telco with a 50+% market share in those zip-codes. If you have 1 in 1000 or even 100 people as customer you can identify which hit will be which customer combined with some digging;

This may seem extreme, but in a case study for medical data it was proven for The Netherlands that people could be identified if only one extra third-party detail was added to make the relation with their "pseudo data entry" (zip-code based). In some situations it was just browsing Google Maps to find that detail.

But as you indicate this is for a financial institution, then you really have to discuss this with your risk manager. Also as others have identified this as an issues in other countries.

Improve this answer
1
  • 3
    Note - in the Netherlands, the 4 digit + 2 letter zip code ("postcode") identifies the address down to (part of) a street - and there are about 440,000 of them, covering on average 17 delivery addresses. There are about 43,000 US zip code (5 digits) that can have a span of a single household or business, or cover many tens of thousands of addresses. There are 44 million "zip+4" codes - enough to identify many households individually. Either way, there is a risk that a zip code may identify an individual as being a customer of the financial institution.
    – Floris
    Commented Jan 1, 2016 at 6:11
3

No, by itself, a zip code is not PII. It's demographic data, but since many thousands of people may live in a single zip code, there's nothing about the zip code alone that would identify which individual(s) it represents. In this case, a zip code may also represent multiple clients, if there are multiple clients of the firm in a single zip code. So, almost by definition, it can't be PII, since it doesn't uniquely identify a single individual.

Improve this answer
1
  • This answer is not only entirely incorrect in those cases where a zipcode identifies a single person or business entity, and also false in the cases where it does not, since there is nothing in any definition of PII that means it must uniquely identify every affected user. For example, there are 38,000 people called "James Smith" in the US alone, but I don't think anyone would argue that a person's full name or address is not PII. Equally, three quarters of houses have more than one occupant, but nobody would argue that the full address is PII.
    – Dewi Morgan
    Commented Jul 12, 2018 at 14:52
3

Zip code is explicitly considered a HIPAA / Safe Harbor identifier (any geographic division smaler than a state / province is PII by HIPAA standards). First three digits of Zip code are usually safe.

From https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html:

B) All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes, except for the initial three digits of the ZIP code if, according to the current publicly available data from the Bureau of the Census:

(1) The geographic unit formed by combining all ZIP codes with the same three initial digits contains more than 20,000 people; and

(2) The initial three digits of a ZIP code for all such geographic units containing 20,000 or fewer people is changed to 000

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .