Topic Library — PII — Personally Identifiable Information (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Topic Library — Year 1 (Foundations) Founded and presented by: Muslim Ordained Minister Destiny Marie Morgan

A note on what this school is: this is community-designed training — Minister Destiny's program, built from lived experience in the neighborhoods being policed. It is not agency policy and does not replace your department's training, general orders, or the law. Where this program proposes new approaches, they are taught and labeled as proposals. Nothing here is legal advice.

Before you start

• This school never collects your name. Progress and quiz answers stay on your device; pass the unit quiz (80% or higher, retakes allowed) and your certificate downloads with a blank name line to fill in after saving. Answers are not shown.
• Few professions touch as much of other people's identifying information as yours: reports, body-camera footage, dispatch audio, victim statements, and database queries all carry PII. This unit extends the Confidential and Redactions units from the officer's side — what PII is, which of it is sensitive, where it lives in police work, and the discipline of collecting, using, and releasing only what the purpose allows.

The lesson

Part 1. What PII is in police work — identifiers, combinations, and records about people

Personally identifiable information is any information that can identify one specific person, alone or combined with other information. In police records the direct identifiers are constant companions: full names, dates of birth, Social Security numbers, license and state ID numbers, addresses, phone numbers, photographs, and fingerprints. Treat each as what it is — a key that fits one person's life.

Combinations deserve the same respect. A name plus a birth date plus an address singles out one person in a database of millions, and a narrative report often assembles far more: employer, vehicle, family members, medical details mentioned at a scene. The Redactions unit taught why released documents arrive with bars across them; this unit teaches the upstream half — everything you write, record, and query is assembled PII from the moment it exists, and its protection begins with how you handle it.

Hold one distinction from the start. A fact's presence in a public record somewhere — an arrest once reported in a newspaper — does not make a compiled file about that person public property. Part 5's case turns on exactly that difference.

Part 2. Sensitive PII on the job — what demands the tightest handling

Rank what passes through your hands. Most sensitive: Social Security numbers, biometric identifiers, financial account information, health information learned at scenes and in statements, and identifying information about children and about victims who could be located or endangered through it. Careless release of this tier can open accounts in a victim's name, expose a protected address, or put a child's clean record in a thief's hands — harms that outlive any case you are working.

Identifying but lower-tier: names, work contact information, and facts already widely public. Lower tier does not mean careless tier. It means the handling question is purpose: who needs this, for this task, under this authority? Massachusetts law builds its protection around a name combined with a Social Security number, a license number, or a financial account number — a useful field guide to which combinations the Commonwealth treats as the dangerous ones.

Part 3. Where PII lives in a department — paper, systems, and the spaces between

Map your own workplace the way the Adult unit maps a home. Paper: reports and statements in cruisers and interview rooms, printed database returns, booking paperwork, evidence envelopes with identifying labels. Systems: records-management and dispatch systems, email, body-camera and in-car video with its audio of names and birth dates spoken aloud, and every database your terminal can reach. The spaces between: a photograph of a report taken "to work on later," a printout left on a court bench, a conversation about a victim held where the public can hear it.

Each location carries the same two questions: who can reach this, and does the purpose still require it in this form? A database return printed for one identification check and left in a shared tray has outlived its purpose while keeping all its risk. The Confidential unit's storage duty — copies are still the information — applies with full force.

Part 4. Who must protect it, and on what authority — duties in outline

Your handling of PII sits inside several frames at once, stated in general terms because department policy and agency counsel govern the specifics. The Privacy Act sets the federal pattern for agency records about individuals — accuracy, relevance, access limited to need — and state law and department policy build the working rules you follow. Massachusetts requires holders of residents' personal information to safeguard it under written security standards, and breach-notification duties attach when it is acquired by an unauthorized person — which the Data Breaches unit teaches from the responder's side.

Two working principles carry most days. Need-to-know access: a record is opened because a duty requires it, not because a terminal permits it. Database access is logged, and curiosity is not a duty — a query run for a friend, a neighbor, or a name in the news is misuse even if nothing is printed. Purpose limitation: information gathered for one lawful purpose is not a general resource for others. The resident who gave a statement as a victim entrusted that information to the investigation, and that trust is, in your hands, backed by policy and law.

Part 5. Compiled records and privacy — the lesson of the rap sheet case

The Supreme Court's Reporters Committee decision, read in Cases & Codes below, draws the line this Part teaches. Reporters sought a man's FBI rap sheet — a single compiled file of arrests, charges, and incarcerations from many jurisdictions. Much of the underlying history had been a public record somewhere, at some time. The Court nevertheless protected the compilation: assembled in one place, by the government, about a private citizen, the file exposed a life in a way scattered records never did. The Court described the older protection as the record's "practical obscurity" — a phrase worth keeping, because it names what compilation destroys.

For police work the application is direct. Your systems compile: a query returns in seconds what once took a week of courthouse visits. That power is also why access rules, release rules, and redaction exist — not as paperwork laid over the work, but as the conditions that make compilation legitimate. When you release a record, release it as your department's rules and the law direct, with identifiers cut down to what the release is for.

Part 6. When PII is mishandled — inside, outside, and your part in the response

Mishandling happens on a spectrum: a misdirected email, a lost printout, an unauthorized query, a breached system. Your duties are consistent across it. Contain and report upward immediately through your chain and your department's process — the hour a loss is reported is the hour its damage can still be limited, and self-reporting a mistake is professionalism, not confession. Preserve what happened: what information, whose, when, and who may have received it; the breach-notification analysis in the Data Breaches unit runs on exactly those facts. Do not compound it: no quiet retrievals, no private arrangements, no deleting the trail.

And when a resident's information was mishandled by anyone — including, on a hard day, your own agency — treat their questions as the Adult unit teaches them to ask: what was involved, what is being done, what should they watch for. The person whose name is in the file is not an interruption to the response. They are its point.

Words to know — PII — Personally Identifiable Information

• Personally identifiable information (PII) — information that can identify one specific person, by itself or combined with other information.
• Direct identifier — a piece of information that points to one person on its own, such as a Social Security number or license number.
• Sensitive personal information — identifying information whose misuse can directly open or empty accounts or expose private life, such as account numbers, passwords, and health information.
• Practical obscurity — the protection information gains when it is scattered and hard to gather, even if each piece is technically a public record.
• Need-to-know access — limiting records to the people whose job duties actually require them.
• Data minimization — collecting only the information needed for a stated purpose, keeping it only as long as needed, and limiting who can touch it.
• Protected health information — health information that identifies a person, held under the health-privacy rules.
• Written information security program — a written plan, required of many holders of personal information, setting out the safeguards that protect it.
• Encryption — transforming data into a form that cannot be read without a confidential process or key.

Myths vs facts — PII — Personally Identifiable Information

• Myth: If the facts were ever public, a compiled file about a person is public too. Fact: Reporters Committee protects the compilation itself. Assembling scattered records into one file about a private citizen is a different and greater exposure.
• Myth: A quick database look-up for personal reasons is harmless if nothing is printed. Fact: Access is logged, and curiosity is not a duty. An unauthorized query is misuse of PII even when nothing leaves the screen.
• Myth: Only digital systems put PII at risk. Fact: Printouts in trays, reports photographed on personal phones, and conversations overheard by the public expose the same information with none of a system's controls.
• Myth: Redaction at release fixes careless handling earlier. Fact: Redaction governs what a released copy shows. It cannot undo an unauthorized query, a lost printout, or an over-shared file.
• Myth: Reporting your own handling mistake only makes trouble for you. Fact: Immediate reporting is what lets a department contain a loss and meet its notification duties. Concealment is the act that compounds the harm.

Think it through — PII — Personally Identifiable Information

The situation: A resident calls the station: an officer she knows socially mentioned, in a group chat, that her address came up in "a call last month," and joked about what the call was for. She asks you, the desk officer, whether officers are allowed to look up and pass around information like that — and what happens now.

Walk it through: (1) Name what the information is (Parts 1–2): her address, tied to her name and to the fact and nature of a police call, is identifying information, and its sensitivity rises because it can locate her. (2) Test the access against Part 4: need-to-know and purpose limitation. A social mention is neither — if the address was reached through a department system for a non-duty reason, that is misuse regardless of whether anything was printed. (3) Apply Part 5 honestly: the resident experiences exactly what Reporters Committee describes — her scattered contact with the department assembled and carried into her social world. Her sense of exposure is the harm the doctrine names. (4) Your moves (Part 6): take the report seriously and in writing, route it through your chain and your department's process the same day, preserve the facts as she states them, and tell her plainly what happens next and who will contact her. Do not investigate your colleague yourself, and do not promise an outcome you do not control.

Cases & codes to study — PII — Personally Identifiable Information

U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (U.S. Supreme Court, 1989)

• The facts: A CBS correspondent and a press organization asked the FBI, under the Freedom of Information Act, for the compiled criminal-history record — the "rap sheet" — of a private citizen whose family company had been publicly linked to organized crime and defense contracts. The FBI refused to release it.
• The question: Does releasing a compiled law-enforcement record about a private citizen invade personal privacy under FOIA's law-enforcement exemption, even when many of the underlying events were once public records somewhere?
• The ruling and the outcome: The Supreme Court held for the Department of Justice and reversed the court of appeals: disclosure of the compiled rap sheet could reasonably be expected to invade personal privacy, and such compiled records about private citizens are protected as a category. The requesters did not receive the record.
• Why it matters to you: Your systems compile in seconds what this case protected as a compilation. That is why query discipline, release rules, and redaction are conditions of the power, not paperwork after it (Parts 4 and 5).
• 📄 Court document: https://supreme.justia.com/cases/federal/us/489/749/ (the full opinion, reproduced at the Justia U.S. Supreme Court Center)

The law itself — read the real words

• 5 U.S.C. § 552a (U.S. Code) — the Privacy Act: sets the rules federal agencies must follow for records about individuals, including accuracy, access, and amendment. Read it: https://uscode.house.gov/view.xhtml?hl=false&edition=prelim&req=granuleid%3AUSC-prelim-title5-section552a
• 18 U.S.C. § 1028 (U.S. Code) — makes fraud involving identification documents, authentication features, and another person's means of identification a federal crime. Read it: https://uscode.house.gov/view.xhtml?req=Hologram&f=treesort&fq=true&num=0&hl=true&edition=prelim&granuleId=USC-prelim-title18-section1028
• 201 CMR 17.00 (Massachusetts regulation) — requires everyone who owns or licenses Massachusetts residents' personal information to maintain a written information security program with administrative, technical, and physical safeguards. Read it: https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-ma-residents

Where to read the real thing, free: CourtListener (https://www.courtlistener.com) for court opinions; the U.S. Code at uscode.house.gov (https://uscode.house.gov); Massachusetts regulations and laws at mass.gov (https://www.mass.gov) and malegislature.gov (https://malegislature.gov).

Try this — PII — Personally Identifiable Information

• ☐ Walk your own work area and list every place PII sits in paper or on a screen; note which entries have no current purpose.
• ☐ State the two working principles from memory: need-to-know access, and purpose limitation.
• ☐ Review your department's process for reporting a misdirected record or lost printout before you ever need it.
• ☐ Explain practical obscurity to a colleague using the rap-sheet example.
• ☐ Check your own habits: no report photographs on personal devices, no returns left in shared trays.

Resources to keep — PII — Personally Identifiable Information

• 911 — for immediate danger to any person on an encounter.
• justice.gov — Department of Justice information on privacy and civil rights.
• mass.gov — official Massachusetts information, including data-protection standards.
• HHS OCR: 1-800-368-1019 — for health-information privacy complaints.
• Free Pathways Guide — this school's guide to turning free study into real credentials at no cost (in the Topic Library).
• 988 (call or text) — support any time an incident becomes a personal crisis.

What you earned / what's next — PII — Personally Identifiable Information

✅ PII — Personally Identifiable Information complete (quiz score 80% or higher): You can define PII and its sensitive tier in police records, map where it lives in a department, apply need-to-know and purpose-limitation discipline, explain why compiled records carry their own privacy protection, and carry out your part when PII is mishandled.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — PII — Personally Identifiable Information

This certificate is presented by Muslim Ordained Minister Destiny Marie Morgan

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You handle the information that describes other people's lives. You now know how to hold it the way you would want your own held — by need, for a purpose, and never by curiosity. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Topic Library for your next Year 1 Foundations unit.

Sources

• CS406: Information Security — Saylor Academy (https://learn.saylor.org/mod/page/view.php?id=29839) — open courseware checked for information-security principles, access control, and privacy-law coverage.
• Foundations of Information Systems, Chapter 6 — OpenStax (https://openstax.org/books/foundations-information-systems/pages/6-summary) — open textbook checked for data privacy, data security, and access-control concepts.
• 201 CMR 17.00 — Standards for the Protection of Personal Information of Residents of the Commonwealth — Mass.gov (https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-ma-residents) — the Massachusetts definition of personal information and the written information security program requirement.
• U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749 (U.S. Supreme Court 1989) — privacy in compiled records about a private citizen; the practical-obscurity idea.
• Title 5 § 552a (U.S. Code) — the Privacy Act: agency duties and individual access and amendment rights for federal records.
• Title 18 § 1028 (U.S. Code) — federal crimes involving identification documents and another person's means of identification.

Your Progress — On Your Device Only — PII — Personally Identifiable Information

• Learning outcomes: On completing this unit, the student can:
• define PII and identify its sensitive tier within police records;
• map where PII is held across a department's paper, systems, and informal copies;
• apply need-to-know access and purpose limitation to database queries and record releases;
• explain why a compiled record about a private citizen carries privacy protection of its own;
• describe the immediate duties that follow when PII is mishandled.
• Study time: Approximately 1 hour — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved only in your own browser on this device, and retakes are allowed.
• Level: Topic Library — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only, not legal advice. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).