What the Government Actually Considers Personal Information —It's More Than You Think

Let's define 2 terms that drive almost everything in this topic: PII and system of records. PII, under the FAR Privacy Clause, means information that can be used to distinguish or trace an individual's identity, either on its own or when combined with other information that is linked or linkable to a specific person. Examples include full name, home address, personal phone number, or personal email; Social Security number, driver's license number, or passport number; date of birth or employee ID number; Financial account information, medical information, biometrics or photos used to identify someone. Now here's the one that many standard office privacy training courses don't fully explain. A system of records is not just any folder, spreadsheet, or database that happens to contain names. Under the Privacy Act, a system of records is a group of records under the control of a federal agency where information is retrieved by looking up a person's name or another identifier, like a Social Security number, employee ID, or case number. The key idea is retrieval by identifier. So if a system lets you pull up Jane Smith and view her file, that type of retrieval is what triggers system of records responsibilities Under the Privacy Act and the FAR clause.