Well, yes.
Handle PII as you would handle live ammo. Always know where you store it. Don't toss it randomly. Don't experiment with it; neutralize it first!
Use it to hit particular targets, and never shoot it at random directions.
Handle PII as you would handle live ammo. Always know where you store it. Don't toss it randomly. Don't experiment with it; neutralize it first!
Use it to hit particular targets, and never shoot it at random directions.
But thing is, PII is not "live ammo". Artificially designating it so simply raises the cost of working with it. Doing that designation through an amazingly dumb law just makes EU Internet startups unfeasible. Meanwhile, US and Chinese startups flourish since they don't have this limitation.
Self-own, really.
A real, practical example is that US web startups do not have to annoy their US users with cookie banners for simply using Google Analytics on their website - like the EU ones must. Underneath, the implementation and PII data protections are exactly the same, but the UX is night and day.