Also known as: PII · personal data · personally identifiable information
Written by attorneys · grounded in primary & secondary sources — see below
Data that identifies or pertains to a particular individual. Such data includes names, addresses, medical prescriptions, passwords, and other details that can be linked to a person. Collection or disclosure of the data is subject to constitutional limits when it implicates privacy or speech interests.
Parker Phillips, a physician, prescribed controlled medications to several patients. The state health department collected the patients' names and addresses into a centralized computer system equipped with access controls and audit logs. Because the safeguards prevented unauthorized disclosure, the collection did not violate any protected privacy interest.
Preston Pratt circulated initiative petitions door to door. A state statute required every circulator to wear a badge displaying his or her full name and address. Because the identification requirement burdened core political speech without being narrowly tailored to a compelling interest, the disclosure obligation was invalid.
Select any source to read its text and confirm it supports the definition.
No. The right of privacy does not bar the state from collecting and computerizing personal information such as the names and addresses of patients prescribed dangerous drugs, provided reasonable safeguards are in place.
Supporting sources
A requirement that petition circulators wear identification badges or otherwise disclose personal information regulates core political speech and is subject to strict scrutiny. Such requirements are presumptively suspect and must be narrowly tailored to a compelling interest.
Supporting sources
A court may adopt the regulatory caller-verification requirement as the standard of reasonable care when the plaintiff is within the class of persons the regulation was designed to protect, such as policyholders and named beneficiaries whose personal data is at risk of identity theft.
Supporting sources
Consent is ineffective when it is induced by a misrepresentation about the nature or extent of the data to be collected, such as when a company describes software as collecting only anonymous performance data while secretly logging passwords.
Supporting sources