PII Types & Categories

Understanding the full spectrum of personally identifiable information is essential for building comprehensive detection systems. PII ranges from obvious identifiers like names to subtle quasi-identifiers that can re-identify individuals when combined.

Direct Identifiers

Direct identifiers can uniquely identify an individual on their own without additional context:

Quasi-Identifiers

Quasi-identifiers do not uniquely identify individuals alone, but can do so when combined. These are often overlooked in PII detection:

• Date of birth: Combined with zip code and gender, can re-identify 87% of U.S. residents
• Zip code / postal code: Narrows location significantly, especially in rural areas
• Gender: Reduces anonymity set by half
• Race / ethnicity: Further narrows identification in small populations
• Job title + employer: Often uniquely identifying for senior roles
• Medical conditions: Rare conditions combined with demographics can re-identify

Named Entity Types for NER-Based Detection

Named Entity Recognition (NER) models classify text spans into entity types. Key entity types for PII detection:

# spaCy default NER entity types relevant to PII
PERSON      # People, including fictional characters
ORG         # Companies, agencies, institutions
GPE         # Countries, cities, states (Geo-Political Entity)
LOC         # Non-GPE locations: mountain ranges, bodies of water
DATE        # Absolute or relative dates
MONEY       # Monetary values
CARDINAL    # Numerals that don't fall into other types

# Extended PII entity types (custom models)
EMAIL       # Email addresses
PHONE       # Phone numbers
SSN         # Social Security Numbers
CREDIT_CARD # Credit card numbers
IP_ADDRESS  # IPv4 and IPv6 addresses
URL         # Web addresses
LICENSE     # License plate or driver's license numbers
MEDICAL_ID  # Medical record numbers

Sensitive Data Categories

Regulations classify certain types of PII as especially sensitive, requiring elevated protection:

• Health information (PHI): Medical records, diagnoses, treatments, prescriptions, insurance IDs. Protected under HIPAA in the U.S.
• Financial information: Bank account numbers, credit card numbers, tax IDs, income data. Subject to PCI-DSS and financial regulations.
• Biometric data: Fingerprints, facial recognition templates, retinal scans, voiceprints. Increasingly regulated (BIPA in Illinois).
• Racial / ethnic data: Special category under GDPR Article 9. Requires explicit consent for processing.
• Political / religious beliefs: Protected under GDPR as special category data.
• Sexual orientation: Highly sensitive, protected under GDPR and various national laws.

HIPAA Safe Harbor De-identification

HIPAA defines 18 specific identifiers that must be removed for Safe Harbor de-identification:

1. Names
2. Geographic data smaller than a state
3. Dates (except year) related to an individual
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers
17. Full-face photographs
18. Any other unique identifying number or code