5.3 Handling Sensitive Information: PII, SPII, Privacy Laws, and Breach Reporting
Key Takeaways
NIST defines PII as information that can be used to distinguish or trace an individual's identity, alone or combined with other information.
Under GDPR, a personal data breach must be reported to the supervisory authority within 72 hours of the firm becoming aware of it, unless it is unlikely to create risk to individuals.
US banking organisations must notify their primary federal regulator within 36 hours of determining that a notification incident has occurred.
Biometric data used to uniquely identify a person is special category data under GDPR Article 9, so selfie-based eKYC needs strict protection.
CAFCA sub-topic 1.5 covers best practice in handling sensitive and private information. That includes definitions of PII and SPII, privacy laws such as GDPR and CCPA, reporting of cybersecurity breaches and incidents, and the consequences of mishandling data. For a FinTech this is daily work. Onboarding collects passports and selfies, monitoring processes device and location data, and investigators assemble case files full of sensitive facts.
PII and SPII
- Personally identifiable information (PII): NIST SP 800-122 defines it as information that can be used to distinguish or trace an individual's identity, alone or combined with other information. Examples include name, address, date of birth, email, phone number, IP address and device identifiers.
- Sensitive PII (SPII): a subset that would cause substantial harm, embarrassment or unfairness if lost or disclosed. US government handling rules give examples such as Social Security numbers, passport and driver's licence numbers, financial account numbers and biometrics. Combinations, such as name plus date of birth plus account number, can also be sensitive.
In AML work, identity documents, biometric templates, SSNs and national IDs, account numbers, and SAR-related information should all be handled as the most sensitive tier.
Key privacy laws
| Law | Scope | Points most relevant to AFC teams |
|---|---|---|
| EU GDPR (and the UK GDPR with the Data Protection Act 2018) | Personal data of people in the EU (UK) processed by firms established there or targeting them | Lawful basis is needed. AML processing usually relies on "legal obligation" (Art. 6(1)(c)). Principles of purpose limitation, data minimisation, accuracy, storage limitation and security apply. Biometric data for unique identification is special category data (Art. 9). Data protection impact assessments are required for high-risk processing. Breach notice goes to the supervisory authority within 72 hours (Art. 33), and to individuals without undue delay if the risk is high (Art. 34). Fines reach €20 million or 4% of worldwide annual turnover, whichever is higher |
| California CCPA (as amended by the CPRA) | Personal information of California residents | Rights to know, delete, correct and opt out of sale or sharing, plus limits on use of sensitive personal information. Data covered by the federal GLBA financial privacy law is largely exempt from the main CCPA duties, but the law's private right of action for certain data breaches still applies |
| US financial privacy and security rules | Banks and non-bank financial institutions | GLBA privacy and safeguards rules. Under the FTC Safeguards Rule, covered non-bank firms must notify the FTC within 30 days of discovering a breach affecting 500 or more consumers. Banks follow the interagency computer-security incident rule (36 hours to notify the primary regulator) and state breach-notification laws |
Privacy and AML working together
Privacy law and AML law are designed to coexist:
- Legal obligation basis. CDD, monitoring and reporting are lawful because AML law requires them. Collecting more than you need, such as copying unnecessary documents or keeping device data forever, is not covered.
- Retention limits. AML laws set minimum retention, typically five years. Some, such as the UK Money Laundering Regulations, also require deleting personal data after the retention period unless another law or consent applies (Chapter 18).
- Subject access requests. A customer under investigation may request their data. The law lets firms withhold information where disclosure would prejudice crime prevention or amount to tipping off. In the UK this is the crime-and-taxation exemption in the Data Protection Act 2018. The decision must be documented and approved by the right people.
- Travel Rule and information sharing. Share only the fields the rule requires, over secure channels, and only with counterparties whose data protection you have assessed.
Best practices
- Data minimisation: collect only what the control needs and mask identifiers in case tools.
- Access control: role-based, least-privilege access with logging. Case files and SAR folders get the strictest permissions.
- Encryption in transit and at rest, plus secure key management.
- Vendor management: data processing agreements, location and transfer safeguards (such as standard contractual clauses), security reviews, and sub-processor lists.
- Secure handling habits: no personal email or unapproved cloud storage; clean-desk and screen-sharing rules; redact data before sending it internally.
- Incident readiness: an incident response plan that maps each type of incident to its notification clocks (privacy regulator, prudential regulator, partner bank, affected customers) and to any SAR obligation for cyber-enabled crime.
Consequences of mishandling data
- Regulatory fines and orders from data protection authorities and financial regulators.
- Notification and remediation costs, litigation and class actions.
- Harm to customers through identity theft and fraud using leaked data.
- Loss of partner-bank or payment-network relationships.
- Criminal exposure if SAR information is disclosed. Tipping off is a crime in the US, UK and many other jurisdictions.
Realistic exam scenario
An investigator emails a spreadsheet of 400 customers' names, dates of birth, SSNs and alert notes to a personal account to "finish over the weekend". The firm discovers it on Monday. The firm must treat this as a security incident and contain it by requesting deletion and preserving evidence. It must assess the notification obligations under each applicable law and regulator rule, and notify the partner bank as the contract requires. It should also consider whether SAR-related information was exposed, and take disciplinary and training action. "No harm done" is not a decision the investigator can make alone.
Common exam traps
- "AML overrides privacy, so any data can be kept forever." Wrong. Retention and minimisation still apply.
- Answering a subject access request by disclosing investigation notes. This risks tipping off.
- Treating IP addresses and device IDs as non-personal. Under GDPR they can be personal data.
- Missing the 72-hour or 36-hour clocks because the incident was not escalated.
Under GDPR, how quickly must a controller generally notify the supervisory authority of a personal data breach that is likely to create risk for individuals?
Within 30 days of discovery
Within 72 hours of becoming aware of it
Only after confirming that data was misused
Within 24 hours of the breach occurring
A customer under active AML investigation submits a data subject access request asking for all records, including internal notes about their transactions. What is the best approach?
Ignore the request until the investigation closes, then answer it in full without any exemptions
Provide everything immediately, including all investigation notes, because privacy rights override AML law
Close the account and delete all the customer's data so that there is nothing left to disclose
Assess whether disclosure would prejudice crime prevention or tip off, and apply and record any exemption
Which data element collected during selfie-based eKYC is special category data under GDPR Article 9 when used to uniquely identify a person?
The customer's email address
The app version number
Biometric facial templates
The customer's preferred language
Sections you finish are checked off in the contents.