Definition of Personally Identifiable Information ("PII")

Definition

“Personal information” means either of the following:

1. An individual’s first name or first initial AND his or her last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
1. Social security number.
2. Driver’s license number or California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual..
3. Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.
4. Medical information.
5. Health insurance information.
6. Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.
7. Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
2. A username or email address, in combination with a password or security question and answer, that would permit access to an online account.

For purposes of this section:

• "Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
• “Medical information” means any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.
• “Health insurance information” means an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records.
• “Encrypted” means rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security.