Questions tagged [pii]
The pii tag has no usage guidance.
1
vote
1answer
55 views
Information leakage through json response
I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users.
Nick name
Location
Rating
...
1
vote
1answer
36 views
How can I encrypt messages sent over AWS PrivateLink?
I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet ...
0
votes
0answers
40 views
Do security breach victims have any meaningful recourse?
OPM Breach
Anthem Health Care
Equifax
The list goes on... If we define meaningful as non-monetary compensation (e.g. services) to protect victims from further victimization stemming from loss of ...
1
vote
1answer
156 views
Can you tell me if my design is secure?
I'm designing a database interface for a system that could store PII. My first focus is on making sure all the data is secure, to do this I have designed the system as follows.
I'm running three ...
3
votes
4answers
861 views
Are employee or badge numbers PII?
We're looking at implementing an Identity Management/Lifecycle system. We're looking at aggregating all our authentication into this system. However, one area of concern is same-name employees, so ...
1
vote
0answers
35 views
Do S3/Azure/GCS bucket names/keys represent personally identifiable information
We have an event-sourced system that uses a forward-only immutable event store.
If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
33
votes
6answers
8k views
Is a standalone phone number considered Personally Identifiable Information?
Personally Identifiable Information (PII) is defined (the example below is from NIST) as (emphasis mine)
Information that can be used to distinguish or trace an individual's
identity, such as ...
0
votes
1answer
81 views
Tokenization - Is it bad practice to reuse tokens?
If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens?
For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
8k views
Is gender considered PII (Personally Identifiable Information) under the GDPR?
Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process.
I work in eCommerce in UX (UK based) and support marketing teams with certain activities.
My ...
0
votes
1answer
159 views
How to securely collect email addresses through a third party website
I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list.
Flow:
User goes to a website hosted by unbounce.com that uses my website's ...
2
votes
1answer
99 views
Secure, Portable Bookmarks
A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps.
So it got me thinking of a roll your own way ...
-1
votes
1answer
37 views
DLP Tool for requirement [closed]
Is there any DLP tool with default policies to comply with south african laws and regulations on PII ?
4
votes
1answer
88 views
How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?
I have a website and mobile app that doesn't store data or PII.
Suppose I'm not subject to any special privacy laws. How can I voluntarily submit myself to an audit to ensure that I'm acting true to ...
0
votes
1answer
469 views
Data Masking in a database [closed]
Background
The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...
