how pii is stolen
many thieves find pii of unsuspecting victims by digging through their trash for unopened mail this can provide them with a person s name and address in some cases it can also reveal information about their employment banking relationships or even their social security numbers nowadays the internet has become a major vector for identity theft phishing and social engineering attacks use a deceptive looking website or email to trick someone into revealing key information such as their name bank account numbers passwords or social security number it is also possible to steal this information through deceptive phone calls or sms messages tips on protecting piiwhile it is not possible to fully protect yourself you can make yourself a smaller target by reducing the opportunities to steal your pii experian one of the top three credit agencies lists several steps that you can take to reduce your surface area for example a locked mailbox or p o box makes it harder for thieves to steal your mail and removing personal identification from junk mail and other documents makes it harder for identity thieves to associate a name with an address also avoid carrying more pii than you need there s no reason to keep your social security card in your wallet 4likewise there are some steps you can take to prevent online identity theft data leaks are a major source of identity theft so it is important to use a different complex password for each online account always encrypt your important data and use a password for each phone or device it is also a good idea to reformat your hard drive whenever you sell or donate a computer 4pii around the worldthe definition of what comprises pii differs depending on where you live in the world the following are the privacy regimes in specific jurisdictions in the united states the government defined personally identifiable in 2020 as anything that can be used to distinguish or trace an individual s identity such as name ssn and biometrics information either alone or with other identifiers such as date of birth or place of birth 5in the european union eu the definition expands to include quasi identifiers as outlined in the general data protection regulation gdpr that went into effect in may 2018 the gdpr is a legal framework that sets rules for collecting and processing personal information for those residing in the eu 61personal information is protected by the privacy act 1988 this law regulates the collection storage use and disclosure of personal information whether by the federal government or private entities later amendments regulate the use of healthcare identifiers and establish the obligations of entities that suffer from a data breach 7the personal information protection and electronic documents act regulates the use of personal information for commercial use this is defined as information that on its own or combined with other data can identify you as an individual 8personally identifiable information vs personal datapersonal data encompasses a broader range of contexts than pii for instance your ip address device id numbers browser cookies online aliases or genetic data certain attributes such as religion ethnicity sexual orientation or medical history may be classified as personal data but not personally identifiable information pii breachesthere have been many instances where customer pii has been stolen from companies often this has resulted in hefty fines the biggest fine on record as of october 2023 was handed to didi global the chinese ride hailing company was fined 8 026 billion yuan 1 1 billion by the cyberspace administration of china for breaching the nation s network security law data security law and personal information protection law other recipients of big fines for failing to adequately protect personally identifiable information include equifax amazon and meta 9one of the most well known cases belongs to meta or facebook as it was then known in the 2010s the profiles of 30 million facebook users were collected without their consent by an outside company called cambridge analytica cambridge analytica got its data from facebook through a researcher who worked at the university of cambridge the researcher built a facebook app that was a personality quiz 1011the app was designed to take the information from those who volunteered to give access to their data for the quiz unfortunately the app collected not only the quiz takers data but also because of a loophole in facebook s system data from the friends and family members of the quiz takers 10as a result over 50 million facebook users had their data exposed to cambridge analytica without their consent 12 although facebook banned the sale of their data cambridge analytica turned around and sold the data to be used for political consulting 10the data breach not only affected facebook users but investors as well in its first quarter q1 2019 report facebook said it accrued 3 billion in legal expenses which it claimed squeezed its operating margin by 20 percentage points and lowered its earnings per share by 1 04 13that was just the start in the years that followed the company continued to rack up expenses and paid billions of dollars in fines the data breach also tarnished its reputation and led some users to stop using the social network website 141015