Questions tagged [pii]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
2answers
202 views

What's the danger of an online resume (a CV)?

I was talking with someone about my resume, and on the subject of my posting it online they said, just be careful with PII ... for your own good :) My reaction to that is How bad can it be? -- and,...
0
votes
0answers
88 views

How to Ask for More Transparency from Companies Handling Our Personal Data

A company's asked me to submit a scan of my passport claiming KYC (Know Your Customer) and AML (Anti-money Laundering) purposes. In times of daily data breaches, what can we ask for a company to be ...
1
vote
1answer
48 views

Why should relatively-public personal identifying information be kept secret online if at all?

I don't want to get hung up on technical terms, just laying out basics for this question: I understand personal identifying information (PII) as that info which is not apparent to people who cross ...
3
votes
2answers
386 views

Documentation for GDPR best practices for partially masking email addresses

I must give certain employees access to a report which contains email addresses. I would like to redact or partially mask these email addresses, but I am having trouble finding official guidance on ...
1
vote
1answer
63 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
2
votes
1answer
115 views

Information leakage through json response

I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users. Nick name Location Rating ...
1
vote
1answer
507 views

How can I encrypt messages sent over AWS PrivateLink?

I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
0
votes
0answers
41 views

Do security breach victims have any meaningful recourse?

OPM Breach Anthem Health Care Equifax The list goes on... If we define meaningful as non-monetary compensation (e.g. services) to protect victims from further victimization stemming from loss of ...
1
vote
1answer
165 views

Can you tell me if my design is secure?

I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows. I'm running three ...
3
votes
4answers
3k views

Are employee or badge numbers PII?

We're looking at implementing an Identity Management/Lifecycle system. We're looking at aggregating all our authentication into this system. However, one area of concern is same-name employees, so ...
1
vote
0answers
35 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
34
votes
6answers
11k views

Is a standalone phone number considered Personally Identifiable Information?

Personally Identifiable Information (PII) is defined (the example below is from NIST) as (emphasis mine) Information that can be used to distinguish or trace an individual's identity, such as ...
0
votes
1answer
103 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
10k views

Is gender considered PII (Personally Identifiable Information) under the GDPR?

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process. I work in eCommerce in UX (UK based) and support marketing teams with certain activities. My ...
0
votes
1answer
225 views

How to securely collect email addresses through a third party website

I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list. Flow: User goes to a website hosted by unbounce.com that uses my website's ...
2
votes
1answer
119 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
-1
votes
1answer
39 views

DLP Tool for requirement [closed]

Is there any DLP tool with default policies to comply with south african laws and regulations on PII ?
4
votes
1answer
90 views

How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?

I have a website and mobile app that doesn't store data or PII. Suppose I'm not subject to any special privacy laws. How can I voluntarily submit myself to an audit to ensure that I'm acting true to ...
0
votes
1answer
634 views

Data Masking in a database [closed]

Background The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...