What would you define as sensitive user data?

Question

A recent previous question of mine had an answer that sparked a different and unrelated question in my mind:

Customer wants to modify the .properties files packaged in our WAR file

The question that I thought of after reading this answer is, just how low-risk is the data being collected on people (non-users, lets just say, "people") in my application?

• A first name and last name
• Company or organization that person currently is employed at.
• (Optional) An email address
• (Optional) A persons phone number
• A photograph of the persons face
• An digitally signed PDF document physically signed with electronic signature pad (a persons hand written signature)

No other sensitive data like social security numbers, credit card numbers or anything that can accurately identify a person with 100% accuracy. How sensitive would you rate the data types listed above? Is identity theft even remotely possible with the above information?

In light of all the recent news outbreaks of hacking successes and data breaches, if such a thing were to happen to my application (assume that I have reasonable security measures, SSL, encrypted passwords with salt, account lock after so many failed attempts, etc...), what kind of a response would be appropriate for my organization in your opinion? Should every attempt be made to notify the persons that this information has been compromised? Is it worth it?

Thanks for sharing your thoughts.

Answer 1

Anything that can be used to harm your users is sensitive

It's not only 'sensitive' when it allows for identity theft, that is but one form of harm.

If data can be used that way depends on the context.

For example: the first and last names and the portrait are definitively sensitive user data in, uhmm, 'adult toy stores', they are not on facebook. The phone number may be non-sensitive for all those who let it print in phone books, but it may be for the unlucky ones that get stalked.

The user is in a better position to judge his context than you, therefore i would consider all of your items sensitve, until proven otherwise or told by the user.

Answer 2

I would answer by looking at the legislation in the countries you will be operating.

For the UK you can look at the 1998 Data Protection Act: http://www.legislation.gov.uk/ukpga/1998/29/section/2.

2 Sensitive personal data.

In this Act “sensitive personal data” means personal data consisting of information as to— (a)the racial or ethnic origin of the data subject,

(b)his political opinions,

(c)his religious beliefs or other beliefs of a similar nature,

(d)whether he is a member of a trade union (within the meaning of the M1Trade Union and Labour Relations (Consolidation) Act 1992),

(e)his physical or mental health or condition,

(f)his sexual life,

(g)the commission or alleged commission by him of any offence, or

(h)any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

I am not a lawyer.

Answer 3

First and last names are good identifiers of people. Not unique, but pretty good. Tie that to a phone number and email address, and you can pretend to be a bank and get their account info. After all, only a legitimate bank would have a person's correct name, phone number, and email address, right? And if you get a photo of the person, you could stalk them too (or do all sorts of other things with it, in their name)!

Answer 4

Well even just their first and last name gives implicit information about their activities. It shows that they're involved with your application. If it were, say, an S&M focused project, then it's fairly sensitive.

How Sensitive? Well sensitivity depends on how much they could be hurt by the release of the information. It also depends on the target. The name, credit card#, and signature of a poor person in debt with a negative credit score isn't all that sensitive. Pretty much anything about a celebrity or famous person can be very sensitive.
Will they be embarrassed?
Will their secrets be exposed?
Will they be spammed?
Will they be phished?
Will they be a victim of Identity theft? (which is mostly credit card fraud but also being falsely signed up for things)
Will they be sued?
Will they arrested?
Will they hunted down by an angry mob with pitchforks and torches?

For your data list? They'd certainly be vulnerable to spam and phishing, for anyone that included email or phone numbers. The photo will probably be considered more "personal", but there's not really a black market for that. The signature is a bit concerning though. With that, and the photo, they could theoretically be signed up for things. But everything I can think of would also want their address, SSN, or such.

What kind of a response would be appropriate for my organization in your opinion? Should every attempt be made to notify the persons that this information has been compromised?

Well yes, if you have a breach like that, the right thing to do would be to inform everyone of exactly what was leaked. It's not so vital that I'd go beyond one mass-email and a notice on your website/service/application/whatever.

Is it worth it?

Monetarily? No. It's egg on your face and doesn't make you a dime. But it should help you sleep at night.

Answer 5

Seems clear

http://www.hipaa.com/2009/09/hipaa-protected-health-information-what-does-phi-include/

Yes, it's in a health-care context, but it's a pretty specific set of guidelines that can be applied to other areas.

Answer 6

There is plenty of information here to improve spam. Matching a name to an email address is plenty. When I get a "Hey Joe" because they guessed my name based on first initial, I know it's bad. A digital image of the signature is pretty personal.

What disadvantage do you see in notifying users? The cover-up will get you into more trouble.