What is Sensitive Personal Information? | DataGrail

Data privacy laws and regulations explicitly emphasize the protection and conscientious handling of individuals’ “sensitive personal information.” This is because sensitive personal information carries far greater risks to individuals should their data be disclosed than “regular” personal information.

If personal identifiable information can still be used to identify a specific individual or their household. What’s special about certain data or informational categories that make them “sensitive”?

Personal vs. Sensitive Personal Information (According to the CCPA)

Comparing personal vs. sensitive information presents a classic “square vs. rectangle” situation, where all sensitive personal information counts as personal information but not vice versa.

Fortunately, data privacy laws and regulations define what categories do and don’t receive this special designation. On the flip side, unfortunately, the privacy frameworks businesses must create to comply with the laws demonstrate subtle inconsistencies across their definitions.

To simplify this breakdown, let’s explore one definition first: the California Consumer Privacy Act (CCPA), as amended by the CPRA. This legislation was the first (and remains the most comprehensive) state privacy regulation data privacy law in the US, making it the perfect place for businesses to start.

Similarities Between Personal and Sensitive Information

Per the CCPA, personal and sensitive personal data (information) can be used to identify an individual or their household. Specifically:

“‘Personal information’ means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

Generally speaking, if an unauthorized party accessing that information can use it to determine who a person is or where they reside, etc., it likely counts as personal information. Typically, Personal information” does not include deidentified consumer information or aggregate consumer information.

Similarities also include explicit consent requirements and the limits of collection and processing activities. Businesses:

Must have individuals’ informed consent prior to or when collecting personal or sensitive information
Cannot collect more data or use it for more purposes than those disclosed without providing additional notice
Must inform individuals of how long it intends to retain the data or the criteria for that decision

Personal and Sensitive Data—Similar Exemptions

Crucially, one last similarity between personal and sensitive information involves the criteria that exempt data from privacy protections as outlined in the CCPA. These CCPA-outlined conditions are:

If it was already publicly available via government records or the business reasonably believes initial publication occurred via the individual’s own actions or widely distributed media
If it was lawfully obtained as a public matter (e.g., via search warrant) and is accurate
If it is de-identified or aggregated

Differences Between Personal and Sensitive Information

The primary difference between personal information and SPI comes down to the privacy stakes involved. If a company violates the privacy of sensitive information, it renders those individuals much more vulnerable. They may become victims of:

Identity theft
Financial fraud
Reputational damage
Harassment or discrimination

Accordingly, the CCPA stipulates additional consideration for any sensitive data categories

Companies must perform these data privacy risk assessments to determine whether they’ve processed sensitive information and if the benefits of doing so for a given purpose outweigh the risks. For CCPA compliance, these assessments fall under the authority of the California Privacy Protection Agency, and final rulemaking is forthcoming.

Additionally, consumers may exercise their right to limit the use of their sensitive information to the following circumstances:

Ensuring data security and integrity
Same-session advertising if the data isn’t disclosed to third parties or used to compile profiles or alter consumer experiences
Performing standard business purposes and operations (e.g., account or customer service, order fulfillment, financing)
Verifying or maintaining service delivery and quality

Consumers exercising this right prevent businesses from using their sensitive information for marketing statistics, advertising or marketing services, or internal research.

Types of SPI

The CCPA explicitly categorizes the following as types of sensitive personal information:

Government identification numbers—specifically, consumers’ social security numbers, driver’s licenses, state identification cards, and passport numbers.
Account log-in, financial accounts, or debit or credit card numbers when combined with access credentials, such as passwords, cybersecurity codes or access codes, PINs
Precise geolocation
Racial or ethnic origin
Religious or philosophical beliefs
Union memberships
Message contents—specifically of physical mail, email, and text messages (unless consumers send these communications directly to a business)
Genetic data
Biometric data used to uniquely identify consumers
Health data
Sexual orientation or activity data

Sensitive Personal Information in Other US State Consumer Privacy Laws

Part of the confusion related to what is sensitive personal information is that, though similar, different privacy laws and regulations may define the data categories they describe (and their compliance-obligated protections) with slight variations.

For example:

Colorado Privacy Act – The CPA doesn’t explicitly designate government ID numbers, union membership, or precise geolocation as sensitive information but does regard any personal information belonging to a known child as such. In comparison, California separately distinguishes privacy rights for those under 16—allowing those between 13 and 16 years old to provide consent and parents or guardians to do so for those under 13. Other data types are roughly equal.
Connecticut Data Privacy Act – The CTDPA also doesn’t explicitly designate government ID numbers or union membership as sensitive information. However, it does include both precise geolocation and data belonging to a known child.
Utah Consumer Privacy Act – The UCPA’s sensitive information categories similarly mirror Connecticut’s except for the “known child” distinction. However, the UCPA is also more notable for the permitted exemptions for otherwise sensitive information:
- Racial or ethnic origin if processed by a video communication service
- Medical history, mental or physical health conditions, medical treatments, or diagnoses if processed by a healthcare professional
Virginia Consumer Data Privacy Act – The VCDPA’s sensitive information categories virtually mirror Connecticut’s.

“Special Categories” Protected by the GDPR

Before California made US history with the first data privacy law, the European Union established the General Data Protection Regulation (GDPR). Under Article 9, the following are listed as “Special Categories”:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data used to uniquely identify natural persons
Sexual orientation or activity data

Relatively equivalent to US definitions and understanding of sensitive information, organizations (“data controllers”) cannot process these types of data without the individual’s (“data subject’s”) explicit consent or due to necessity. Permitted instances include employment, social security, legal claims, human services like an individual’s self-publication, healthcare delivery, public health, and public interest, or historical, scientific, or statistical research.

As with the CCPA, data controllers subject to the GDPR must perform regular risk assessments for large quantities of “Special Category” data. However, these official Data Protection Impact Assessments ( DPIA) are more rigorous. Per Article 35, a DPIA consists of:

The proposed processing activities and their purpose
An evaluation of the data’s “proportionality” to its purpose
An evaluation of the risks processing poses to the data subject
Risk mitigation efforts

Considerations When Utilizing Sensitive Personal Information

Businesses managing “sensitive personal information” and “special category” personal data should consider the following:

Notices at collection. Ensure individuals are notified of their rights and provide resources for them to learn more.
Data Protection / Privacy Impact Assessments.
Cybersecurity assessments. Evaluate cybersecurity implementations and configurations regularly to ensure any personal or sensitive information stored within company-owned environments is sufficiently protected.
Data to processing mapping. Track and map all personal and sensitive information collected, processed, and stored.
Company policies. Evaluate policies and procedures to ensure they reflect and respect the spirit of data privacy regardless of a given law or regulation’s applicability or requirements, such as establishing standard data retention timelines and criteria for deletion.
Data subject requests. <restrictions on out-of-context SPI uses; explicit opt-out under CCPA, opt-in under VCDPA, legal basis + objection/restriction under GDPR>

These efforts will strongly position any business’ for compliance success (and help improve its consumer reputation).

Simplify Data Privacy Compliance with DataGrail

Even with the distinctions between personal and sensitive information, businesses sifting through the different definitions and protection requirements can easily encounter major interpretation or implementation challenges. However, implementing DataGrail’s platform streamlines and simplifies your data privacy processes.

Our all-in-one data privacy platform provides a Live Data Map, a Request Manager to handle data subjects exercising their rights, and a Risk Monitor to conduct risk impact assessments.

Table of Contents