Ethical issues in the collection and release of personally identifiable information

Ethical Problem of Personally Identifiable Information (PII)

Personally Identifiable Information (PII) refers to any information that can be used to identify the person. According to the U.S. Office of Management and Budget, it consists of the following criteria:

National identification number

IP address (in some cases)

Vehicle registration plate number

Driver's license number

Face, fingerprints, or handwriting

Credit card numbers

Digital identity

Date of birth

Birthplace

Genetic information

The Office of Management and Budget (OMB) defines PII in the following way:

Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother's maiden name, etc. ( Johnson III, 2007).

The directive 95/46/EC meanwhile describes it as:

Article 2a: 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data)

Collecting PII is necessary for both private and domestic safety and use. In the first place, it helps the federal government and place of employment, medical institution, and so forth connects with the individual, employee, or patient. In the second place, it helps the government better protect the country from terrorists. On the other hand, because PII involves breaching privacy, the effect is that some may be disturbed by the ramifications feeling that the government has encroached too much on their personal lives. Consequences are aggravated when PII of certain very public figures are released.

Ethics is defined as "the discipline dealing with what is good and bad and with moral duty and obligation" (Merriam-Webster). In other words, it is the system of values / principles that the individual uses in order to decide how to act in any given challenging moral situation. It is the person's guiding philosophy in determining how to act. Releasing PII may well result in an ethical conundrum. The following essay elaborates on the ethical issues involved and suggests some solutions.

The issues

Although intended for domestic and utilitarian reasons, PII can sometimes by used criminals as means of stalking, kidnapping, robbing a person, or even plotting his murder. Sometimes, it may be used to kidnap a close relative of a particular individual in order to force the individual to collaborate. Releasing and publicizing PII, in this way, can be dangerous. Advances in internet technology has not only made it easier to collect PII but, at the same time, has made it easier for unscrupulous individuals to breach internet security and web browser security gaining access to this information and, sometimes, selling it to others. This practice is called "doxing" (Sweeney, n.d)

Various policies and interventions have been passed to protect the person's identity. One of the best known is the Health Insurance Portability and Accountability Act (HIPAA) which aims to protect a patient's identity. The Privacy Act of 2005 likewise forbade the display, sale, or purchase of another's PII without his consent, whilst the Anti-Phishing Act passed in that same year protected acquisition of PII through phishing. In a similar way, and given the seriousness of the social security number that can lead to identity theft, the proposed Social Security Number Protection Act (2005) and Identity Theft Prevention Act (2005) sought to regulate distribution of an individual's social security ID.

These policies -- and proposed policies -- have, however, been insufficient. Certain people in certain positions are especially vulnerable to danger were their PII to be exploited. Force may be used that they, or their beloved ones, may be kidnapped or harm threatened to them in order that they cooperate. At the moment, the United States Department of Defense (DoD), and many other intelligence agencies, strictly control release of PII of DoD personnel (United States Department of Defense). Similar steps of protection are also assumed by institutions set up to protect victims (or potential victims) such as witness protection programs, women's shelters, and victims of domestic violence. Nonetheless, internet breach occurs routinely; further steps need to be taken.

Conclusion

Personally Identifiable Information (PII) is any sort of information that identifies a person and that institutions and the government use for private and domestic concerns. The ethical problem inherent in PII is that unscrupulous individuals can abuse the concept robbing a person of their personal identity or, in other ways, using the PII to force the person to cooperate. It is extremely important, therefore, to safeguard the person's PII and the more vulnerable the individual the more important protection of PII becomes.

Laws have been passed for PII protection but breaches persist. Recommendations, therefore, include passage of a new category of PII (PII 2.0) that more strictly defines PII and divides it into two categories enabling relevant institutions to beater identify the individual and to choose which data to include and which to exclude. These bits of data can also be placed along a spectrum.

National and logistical matters necessitate that we be uniquely identified. Doing this can, however, be occasionally, harmful. Steps have been, and can continue to be taken, to guarantee a person's safety.

Source

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:EN:HTML

Johnson III, Deputy Director for Management (2007/05/22) M-07-16 SUBJECT:Safeguarding Against and Responding to the Breach of Personally Identifiable Information http://www.whitehouse.gov/omb/memoranda/fy2007/m07-16.pdf

Merriam-Webster.

http://www.merriam-webster.com/dictionary/ethic

Schwartz, PM & Solove, DJ (2011) the PII Problem: Privacy and a New Concept of Personally Identifiable Information New York University Law Review, Vol. 86, p. 1814,

Sweeney, L (n.d.) Standards of Privacy of Individually Identifiable Health Information. Carnegie Mellon University. http://privacy.cs.cmu.edu/dataprivacy/HIPAA/HIPAAcomments.html

United States Department of Defense. "MEMORANDUM for DOD FOIA OFFICES." http://www.dod.mil/pubs/foi/withhold.pdf)