School: Minister Destiny Testimony Schools Track: Adult Class: Topic Library — Year 1 (Foundations) Founded and presented by: Muslim Ordained Minister Destiny Marie Morgan
This lesson is educational information, Massachusetts-first, and is not legal advice. Laws and procedures vary by state and by case. If you are in danger right now, call 911. If you have a real case, talk to a lawyer — legal aid organizations help many people for free.
Before you start
- This school never asks your name. Your progress is saved only in your own browser on this device — the school collects and keeps nothing. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
- This unit extends the Confidential and Redactions units: those taught how entrusted information and redacted documents are handled. This unit goes one layer deeper — the information itself. By the end you will be able to look at any form, app, or file cabinet and name which pieces are PII, which are dangerous, and which nobody needed to collect at all.
The lesson
Part 1. What PII is — information that points to one person
Personally identifiable information — shortened to PII — is any information that can identify one specific person, by itself or combined with other information. Your full name alone is PII. So is a Social Security number with no name attached: the number belongs to exactly one person.
Two families of PII matter. Direct identifiers point to you on their own: full name, Social Security number, driver's license or state ID number, passport number, fingerprint or face image, and a financial account number that can reach your money. Indirect identifiers point to you only in combination: birth date plus ZIP code, employer plus job title in a small office, a rare diagnosis plus a town. Alone, each piece looks harmless. Assembled, they single out one person — which is why this school teaches you to judge combinations, not just single fields.
Notice what PII is not. A fact can be publicly known — your name is on a mailbox — and still be PII, because the question is identification, not secrecy. The Confidential unit taught that confidential information is entrusted with an expectation of privacy; PII is the wider category underneath it, and much of the law in this cluster protects PII whether or not anyone promised anything.
Part 2. Sensitive and non-sensitive PII — why some pieces weigh more
Not all PII carries the same risk, and treating every piece alike leaves the dangerous ones unguarded. Sensitive PII is information whose misuse can directly open accounts, empty them, or expose the private core of a life: Social Security numbers, financial account and card numbers with any unlocking code, passwords and PINs, health information, biometric identifiers, and a child's identifying information. Massachusetts law draws a version of this line in its own definition, taken up in Part 5 and Cases & Codes: a name combined with a Social Security number, a license number, or a financial account number is the combination the state's protection rules are built around.
Non-sensitive PII — a name by itself, a work email address, a business phone number — is still identifying and still deserves care, but its misuse usually begins a chain rather than finishing one: it is the piece a scammer uses to find the next piece. The practical rule is a ladder: the higher a piece sits — the more directly it unlocks money, care, or identity itself — the fewer hands, forms, and screenshots it should touch.
Information about children deserves its own sentence. A child's identifiers can sit unused in a file for a decade before anyone checks them, which is exactly what makes them valuable to thieves — the Identity Theft unit teaches that danger in full; guard children's PII as sensitive from the start.
Part 3. Where PII lives — paper, phones, schools, clinics, and employers
PII does not live only in databases. Walk through an ordinary week and count the holders. Paper: tax forms in a drawer, a benefits letter on the counter, a school enrollment packet in a backpack. Phones and computers: contacts, photos of documents taken "just to have them," email inboxes holding years of forms, apps that asked for a birth date and kept it. Schools: enrollment, health, discipline, and meal-program records. Clinics and health plans: intake forms, insurance cards, patient portals. Employers: applications, payroll records, emergency-contact sheets, copies of ID in a manager's file.
Each holder is a door, and each door has its own lock — or none. That is why the Redactions unit's habit matters: when a document travels, the PII inside should be cut down to what the receiver actually needs. Your home deserves the same thinking an office gets — a folder of unshredded statements is, in miniature, an unprotected records room. Knowing where your PII lives is the inventory every later step depends on.
Part 4. Who must protect PII — and the idea of collecting less
Protection duties come from several directions at once. Federal law sets rules for particular keepers: the Privacy Act governs how federal agencies keep records about individuals, health-privacy rules govern health information held by care providers and health plans, and the FTC's Safeguards Rule requires many financial institutions to run a written information-security program. Massachusetts adds its own layer for anyone who holds residents' personal information, taught in Part 5. Sector by sector, the pattern repeats: the keeper must limit access to people with a job-based reason, secure records in paper and electronic form, and answer when something goes wrong.
Underneath it all sits one principle: data minimization — collect only what you need for a stated purpose, keep it only as long as that purpose requires, and let only the people who need it touch it. Minimization is also a personal strategy, and Part 6 turns it into habits. Every form you decline to overfill is a breach that cannot happen, because the information was never there.
Part 5. Your rights over your own information
Rights vary by keeper and by law, but a common core runs through American privacy law. In general terms: you often have a right to know what records an organization holds about you, to see them, to ask for corrections when they are wrong, and to be told why information is collected and how it will be used. The Privacy Act gives these rights concrete federal form for agency records: individuals may access records about themselves in a federal system of records and request amendment of records that are not accurate, relevant, timely, or complete. Health records carry their own access rights, taught in this school's medical units.
Two honest limits. First, no single American law hands you every right over every holder; rights attach keeper by keeper, which is why "what law covers this holder?" is the right first question. Second, a right you never use protects no one. Read privacy notices for the sentences that say what is collected and who it is shared with, ask why a form needs a Social Security number before you write it, and use the correction channels that exist — an error corrected in the holder's file stops traveling.
Part 6. Sharing less — and what to do when a holder mishandles yours
Minimizing what you share is a set of small refusals and substitutions. Ask what a field is for before filling it; many forms request information the transaction does not require. Decline to put a full Social Security number where a last-four will do, and ask how a copy of your ID will be stored and when destroyed. Keep photos of documents off your camera roll unless you need them, shred paper carrying sensitive PII, and treat requests by text or email — even friendly ones — with the Cyber Security Awareness unit's stop-and-verify procedure, because "collecting PII" is precisely what phishing does.
When an organization mishandles your information, your moves, in order, are these. Preserve: keep the notice, letter, or screenshot, with dates. Ask in writing what information was involved, what the organization is doing, and what it offers you; written questions create written answers. Protect: the Data Breaches unit teaches the full response, and the Identity Theft unit's plan — freezes, alerts, and the FTC report — is the engine when identifiers were taken. Complain through the channels that exist: the organization itself, the Massachusetts Attorney General's consumer channels through mass.gov, and HHS OCR at 1-800-368-1019 when health information is involved. You are doing the part of the system that only the person the information describes can do.
Words to know — PII — Personally Identifiable Information
- Personally identifiable information (PII) — information that can identify one specific person, by itself or combined with other information.
- Direct identifier — a piece of information that points to one person on its own, such as a Social Security number or license number.
- Sensitive personal information — identifying information whose misuse can open or empty accounts or expose private life, such as account numbers and passwords.
- Data minimization — collecting only the information a stated purpose needs, keeping it only as long as needed, and limiting who can touch it.
- Practical obscurity — the protection information gains when it is scattered and hard to gather, even if each piece is technically a public record.
- Protected health information — health information that identifies a person, held under the health-privacy rules.
- Encryption — transforming data into a form that cannot be read without a confidential process or key.
- Need-to-know access — limiting records to the people whose job duties actually require them.
- Written information security program — a written plan, required of many holders, setting out the safeguards that protect personal information.
Myths vs facts — PII — Personally Identifiable Information
- Myth: If a fact about me is public, it is not PII. Fact: PII is about identification, not secrecy. A public name still identifies, and combinations of public facts can single a person out.
- Myth: Only hackers put PII at risk. Fact: Ordinary handling — an overfilled form, an unshredded statement, an ID photo in a camera roll — exposes more PII daily than any single attack.
- Myth: Every field on an official-looking form is required. Fact: Forms often ask habitually. Ask what a field is for, and what happens if you leave it blank.
- Myth: Once an organization has my information, I have no say. Fact: Access, correction, and complaint rights exist keeper by keeper. Asking which law covers the holder is the first move.
- Myth: Children's information is not worth protecting because children have no accounts. Fact: A child's clean, unchecked record is exactly what makes it valuable to thieves.
Think it through — PII — Personally Identifiable Information
The situation: A community sports league asks Rosa to complete a paper registration packet for her ten-year-old: full name, birth date, home address, school, a photo of the child's insurance card, and — on the last page — the child's Social Security number, "for our files." The league keeps packets in a binder at the concession stand. Rosa asks you whether to fill it all in.
Walk it through: (1) Inventory the PII (Part 1): name plus birth date plus address combine easily; the insurance-card photo and Social Security number are sensitive PII under Part 2 — and they belong to a child, which raises the guard. (2) Ask Part 4's minimization question: what does running a youth sports team actually require? A name, an emergency contact, and allergy information serve the purpose; a Social Security number serves no coaching purpose at all. (3) Storage matters (Part 3): a binder at a concession stand is not need-to-know access or a secured record. (4) Rosa's moves (Part 6): complete what the activity genuinely needs, leave the Social Security field blank, ask in writing how packets are stored and when destroyed, and offer insurance information to a coach directly if emergency need is the real concern.
Cases & codes to study — PII — Personally Identifiable Information
U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (U.S. Supreme Court, 1989)
- The facts: A CBS correspondent and a press organization asked the FBI, under the Freedom of Information Act, for the compiled criminal-history record — the "rap sheet" — of a private citizen whose family company had been publicly linked to organized crime and defense contracts. The FBI refused.
- The question: Does releasing a compiled law-enforcement record about a private citizen invade personal privacy under FOIA's law-enforcement exemption, even when many underlying events were once public records somewhere?
- The ruling and the outcome: The Supreme Court held for the Department of Justice and reversed the court of appeals: disclosure of the compiled rap sheet could reasonably be expected to invade personal privacy, and such compiled records about private citizens are protected as a category. The requesters did not receive the record.
- Why it matters to you: This case stands behind the idea of practical obscurity (Part 1): information scattered across courthouses is one thing; the same information assembled into one file about one person is far more exposing — which is why combinations of PII deserve protection, not just single secrets.
- 📄 Court document: https://supreme.justia.com/cases/federal/us/489/749/ (the full opinion, reproduced at the Justia U.S. Supreme Court Center)
The law itself — read the real words
- 5 U.S.C. § 552a (U.S. Code) — the Privacy Act: sets the rules federal agencies must follow for records about individuals, including access and amendment rights. Read it: https://uscode.house.gov/view.xhtml?hl=false&edition=prelim&req=granuleid%3AUSC-prelim-title5-section552a
- 18 U.S.C. § 1028 (U.S. Code) — makes fraud involving identification documents, authentication features, and another person's means of identification a federal crime. Read it: https://uscode.house.gov/view.xhtml?req=Hologram&f=treesort&fq=true&num=0&hl=true&edition=prelim&granuleId=USC-prelim-title18-section1028
- 201 CMR 17.00 (Massachusetts regulation) — requires everyone who owns or licenses Massachusetts residents' personal information to maintain a written information security program with administrative, technical, and physical safeguards. Read it: https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-ma-residents
Where to read the real thing, free: CourtListener (https://www.courtlistener.com) for opinions; the U.S. Code at uscode.house.gov (https://uscode.house.gov); Massachusetts law at mass.gov (https://www.mass.gov) and malegislature.gov (https://malegislature.gov).
Try this — PII — Personally Identifiable Information
- ☐ Inventory one drawer and one phone folder: list every document or photo carrying sensitive PII, and shred or secure what you no longer need.
- ☐ Practice the question "What is this field for, and what happens if I leave it blank?" before your next form.
- ☐ Check one child's documents: where are they stored, and who has copies?
- ☐ Find one service's privacy notice and read only for two answers: what is collected, and who it is shared with.
Resources to keep — PII — Personally Identifiable Information
- 911 — if you are in danger right now.
- ftc.gov — FTC consumer guidance on protecting personal information.
- mass.gov — Massachusetts consumer protection information.
- HHS OCR: 1-800-368-1019 — for complaints about how health information was handled.
- Free Pathways Guide — this school's guide to turning free study into real credentials (in the Topic Library).
- 988 (call or text) — support any time a crisis follows from misuse of your information.
What you earned / what's next — PII — Personally Identifiable Information
✅ PII — Personally Identifiable Information complete (quiz score 80% or higher): You can define PII, separate direct identifiers from combinations, rank sensitive against non-sensitive information, map where PII lives, state who must protect it, name your rights over your own information, and act when a holder mishandles it.
Your certificate
Minister Destiny Testimony Schools Certificate of Completion — PII — Personally Identifiable Information
This certificate is presented by Muslim Ordained Minister Destiny Marie Morgan
Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)
Date completed: ______________
Congratulations. You can now see the information that describes a life — and you know how to keep it in fewer, safer hands. — Minister Destiny Marie Morgan
This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone.
What's next: Return to the Topic Library for your next Year 1 unit.
Sources
- CS406: Information Security — Saylor Academy (https://learn.saylor.org/mod/page/view.php?id=29839) — open courseware checked for information-security principles, access control, and privacy-law coverage.
- Foundations of Information Systems, Chapter 6 — OpenStax (https://openstax.org/books/foundations-information-systems/pages/6-summary) — open textbook checked for data privacy, data security, and data minimization concepts.
- 201 CMR 17.00 — Standards for the Protection of Personal Information of Residents of the Commonwealth — Mass.gov (https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-ma-residents) — the Massachusetts definition of personal information and the written information security program requirement.
- U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (U.S. Supreme Court 1989) — privacy in compiled records about a private citizen; the practical-obscurity idea.
- Title 5 § 552a (U.S. Code) — the Privacy Act: agency duties and individual access and amendment rights for federal records.
- Title 18 § 1028 (U.S. Code) — federal crimes involving identification documents and another person's means of identification.
Your Progress — On Your Device Only — PII — Personally Identifiable Information
- Learning outcomes: On completing this unit, the student can:
- define PII and distinguish a direct identifier from a combination of indirect identifiers;
- classify information as sensitive or non-sensitive PII and explain the different risks;
- list where PII is held across paper, devices, schools, clinics, and employers;
- explain data minimization and the written information security program Massachusetts requires;
- state the access and correction rights a person may hold over their own information;
- describe the first steps to take when an organization mishandles their information.
- Study time: Approximately 1 hour — an estimate covering reading, activities, and the test. Students move at their own pace.
- Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved only in your own browser on this device, and retakes are allowed.
- Level: Topic Library — Year 1 (Foundations) · Adult school · working rank on completion path: Freshman → Sophomore.
- Version: Version 1.0 — October 2026.
Minister Destiny Testimony Schools — Adult. Educational information only, not legal advice. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).