Contact

GlossaryPublic records, privacy, and data quality

Personally identifiable information

Personally identifiable information can identify someone directly or through linked details. Learn what PII means when reading public-safety records.

Personally identifiable information, or PII, is information that identifies a person or can be connected to a person. It can include an obvious identifier, such as a name, or details that become identifying when combined. The relevant privacy rules and the context determine how the information must be handled.

More than a name field

The National Institute of Standards and Technology includes information that can distinguish or trace an identity and information linked or linkable to an individual in its PII guidance. Its examples include identifying numbers and personal information connected to a person. NIST SP 800-122, section 2.1.

For a reader of public-safety data, the key question is what the released details reveal together. Removing a name does not automatically resolve the identifying value of an exact location, precise time, or unusually specific description. Privacy review therefore concerns the released record as a whole.

Example

Hypothetical: A published incident summary excludes the resident's name but includes an exact home address and a detailed description of a private medical event. A second version shows only a broader area and a general service category.

Both versions describe activity, but they disclose different amounts of personal detail. The example does not establish that either version meets a particular legal standard. It shows why checking only for a name field would miss other potentially identifying information.

Common confusion

PII is a category of information, not a universal instruction to release or withhold every record containing it. A particular disclosure decision depends on the applicable law, the record, and the relevant exceptions or requirements. NIST's federal information-security guidance is not a substitute for each jurisdiction's public-records rules.

PII also differs from an anonymous statistic. A citywide count usually communicates a different kind of information from a row describing one identifiable person's experience. However, increasingly detailed tables can still require privacy review, especially when they describe very small groups.

Why readers may see less detail

A public version may omit or generalize information retained in an agency's operational system. That difference should be explained through the publisher's release policy and field definitions. A missing name or masked location is not, by itself, evidence that the underlying event was not recorded.

When interpreting a public map or summary, use the level of detail actually released. Do not treat a generalized point as an exact address or fill in a person's identity from an incomplete record.

Sources