entity resolution

Approaching "Big P.I.I."

Is your pet’s name P.I.I. (personally identifiable information)? In the era where data is bought, sold, and reaggregated the answer has to be “Yes!” If you find yourself asking whether something is P.I.I. then you should probably treat it as such.

A few years ago, it would have been silly to take a stand saying that your pet’s names are your P.I.I. Perhaps what we all didn’t quite anticipate was how the data we share over here, the data we share over there would likely be reunited in a single file by one of the many firms that aggregates and resells data. There are many bits of information about you that seem innocuous, certainly not so obviously compromising as an SSN or credit card number, but the reality is that when all the available information is collected about you, every little bit matters.

The world of 2019 has a lot more people than names, and when you think about it we end up using odd bits of information in maintaining our identity. Your bank may ask you where you met your partner, the names of pets, etc. and I am sure that each reader can come up with some more examples of their own. This is in part an effort to avoid more circulation of more intrinsically dangerous information like government ID numbers, but the result is that all these little facts then become and stay sensitive. If you could tell Facebook your cat’s name and Robinhood where you bank without them comparing notes behind your back, the situation would not be so bad, but this sort of behind the scenes aggregation is a pervasive part of the data economy and it is unlikely to go anywhere soon.

To change resolution a bit, there will always be a lot of other people out there with personal information that looks a bit like yours - same name, similar address, and so on - and there will always be someone digging a bit deeper for that last piece of data that identifies you the human uniquely. There are all manner of organizations working on this all the time, with motives both friendly and hostile to you, and they are eager to get that marginal value out of the names of your pets. And it should be noted that there have already been notable breaches of large aggregated datasets of information on millions of consumers with details including information on pets and more.

Until there is a major change in the regulatory climate, or some other seismic shift, definitions of P.I.I. must become more and more expansive. If you can use it to tell the difference between you and someone else that shares your name, someone will use it for this purpose, and anyone you share it with might decide to hoard it until it becomes interesting later - interesting to them, or interesting to someone else who wants to buy it.