Home
West Virginia Executive Branch
Privacy Tip of the Week
Limited Data and Direct Identifiers
Question:
Wow – we had a “scare” at our office recently! We thought a document with personally identifiable information (PII) had been sent to the wrong person (luckily, we were wrong). Is there a way for State agencies to limit the amount of PII they collect, use or share with others?
Answer:
The concepts of “minimum necessary” and “limited use” are critical parts of our commitment to privacy and fair information practices. Our commitment to “minimum necessary” means that:
We are committed to collecting from our employees and the citizens we serve only those elements of personally identifiable information (PII) which are relevant and appropriate for our business purposes.
Additionally, we will only require individuals to provide PII if that PII is necessary for a specific purpose or to comply with law.
We are often requested to provide data to others, or we may need to use it ourselves. When using, disclosing, or requesting PII, we should also consider if we can use de-identified data that excludes direct identifiers of the individuals who are the subjects of the PII. Direct identifiers include the following:
Name;
Postal address information, other than town or city, state, and zip codes;
Telephone numbers;
Fax numbers;
Electronic mail addresses;
Social security numbers;
Medical record numbers;
Health plan beneficiary numbers;
Account numbers;
Certificate/license numbers;
Vehicle identifiers and serial numbers, including license plate numbers;
Device identifiers and serial numbers;
Web Universal Resource Locators (URLs);
Internet Protocol (IP) address numbers;
Biometric identifiers, including finger and voice prints; and
Full face photographic images and any comparable images.
It may not always be possible to remove these identifiers, but if you can remove them, it’s a best practice!
Note: Your agency/bureau/department/division may have specific requirements – always check your policies and procedures. If you have questions, contact your Privacy Officer.