Personal Information and Its Exclusions
All five define personal information as data linkable to an individual, going beyond breach-notification definitions. California uniquely includes household and employment data. Common exclusions: deidentified data, publicly available data, aggregate data, employee data, and federally regulated data.
How this supports CIPP/US study
Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US exam questions.
In all five states, personal information means data that can be associated or linked with a particular individual - broader than the narrow definition in breach-notification laws. California uniquely extends it to the consumer's household and is the only state to include employment data.
| Exclusion | Which states |
|---|---|
| Deidentified data | All five |
| Publicly available information | All five |
| Federally regulated data (HIPAA, GLBA, FCRA, DPPA) | All five (generally) |
| Aggregate data | California, Utah, Virginia (explicitly) |
| Employee/employment data | Connecticut, Utah, Virginia exclude it; Colorado limits it to employment records |
While deidentified and publicly available data are excluded by all five, aggregate data is explicitly excluded only by California, Utah, and Virginia. Don't assume all exclusions are uniform.
Key terms - quick answers
What is “Personal information”?
What is “Deidentified data”?
What is “Publicly available information”?
What is “Aggregate data”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.