Security & Privacy: What Is PII & How Is It Protected?

Security & Privacy: What Is PII & How Is It Protected?

by Antonette Igbenoba, Esq., CIPP-US, CIPM

The definition of Personally Identifiable Information (PII) varies per country.  Generally, in the United States, PII is considered data that uniquely identifies, contacts or locates a single person, including national ID, date of birth, street address, driver’s license, telephone numbers, internet protocol (IP) addresses, vehicle registration, etc.

This definition is similar to the European Union’s (EU) definition of Personal Data (PD), which is the EU’s synonym for PII. The EU’s General Data Protection Regulation states that Personal Data is “any information (directly or indirectly) relating to an identified or identifiable natural person”, whether publicly available or not.

When dealing with personal information, regardless of the country or region, data controllers should be aware of industry standards that dictate how personal information should be processed and secured. Payment processors must be aware of the Payment Card Industry Data Security Standard (PCI DSS). This rigorous standard applies to all organizations worldwide that collect, process, store, or transmit cardholder information from any card branded with the logo of one of the credit card networks.

In order to be PCI DSS compliant and protect consumers’ PII, payment processors are required to maintain the following 12 security measures:

  1. Build and Maintain a Secure Network and Systems.
    1. Install and maintain a firewall configuration to protect cardholder data.
    2. Use original passwords. Do not use vendor-supplied defaults for system passwords and other security parameters.
  2. Protect Cardholder Data.
    1. Protect stored cardholder data.
    2. Encrypt transmission of cardholder data across open, public networks.
  3. Maintain a Vulnerability Management Program.
    1. Protect all systems against malware and regularly update anti-virus software or programs.
    2. Develop and maintain secure systems and applications.
  4. Implement Strong Access Control Measures.
    1. Restrict access to cardholder data by business need to know.
    2. Every person with computer access must be assigned a unique ID.
    3. Physical access to cardholder data must be restricted.
  5. Regularly Monitor and Test Networks.
    1. Track and monitor all access to network resources and cardholder data.
    2. Regularly test security systems and processes.
  6. Maintain an Information Security Policy.
    1. Maintain a policy that addresses information security for all personnel.

The ePayments industry maintains extremely tight security regulations and practices designed to protect credit card and PII. Encryption, twelve compliance measures, and over 400 security standards set by the PCI SSC make credit card and PII safer than you likely realize.  Our next article will delve into encryption, the difference between a hack and a breach, what attackers are seeking, and the truth about how difficult it is for them to find the information that they really want.

Listen to audio blog here.  Listen to podcast interview here.  Watch video interview here.

Listen to last week’s podcast, “Fees:  Options to Minimize Revenue Impact? “, here.

Take a sneak peek at our next blog article, “Encryption:  What Is It & How Does It Protect My Credit Card Information?”, here.

Explore The Knowledge Center library here.