See a PIN and pick it up? Permission marketing experts Rosemary Smith and Jenny Moseley take a closer look at use of Personal Identity Numbers.

I was recently somewhat taken aback when I received a request from my building society to provide my National Insurance number. Given the length of the relationship (more than 25 years) this clearly wasn’t a legally required identity check. Apparently, it was needed to keep records ‘up to date and accurate’ and to be used in security checks.

Now, I can understand why they want a vital piece of my official identity – there are quite a few Smiths in the UK and having this Personal Identity Number (PIN) is a near infallible way of making sure they are communicating with the right one. But 

I couldn’t help feeling that this was possibly ‘excessive’ data collection and therefore in breach of the third data protection principle.

This is a dilemma many organisations face when seeking to gather useful data: Just where are the boundaries of ‘excessive’?

Maybe it’s a British thing. We’ve had a great debate here about the prospect of compulsory ID cards, yet another form of official PINning. The Government has now back-tracked and ID cards will be voluntary only; the other political parties have said they would shelve the whole idea. Contrast this with the rest of Europe where 11 countries have successfully introduced ID card schemes.

Unlike the historic situation in the USA where Social Security numbers (SSNs) have been widely available for commercial use, the UK Government has steadfastly refused to release National Insurance numbers. Given the prevailing climate surrounding the restriction of public data use this is unlikely to change when/if ID cards are introduced.

However, the freedom to collect and use SSNs in commercial databases in the US is being eaten away because of the fear of identity theft. The Government Accountability Office has found that more than half of the US states now have some form of statutory restriction on displaying SSNs in public records.  

Where’s the alternative?

So, where to look for an alternative to government ID numbers? In the digital world, a static IP address may well be a substitute but the data protection authorities in Europe already believe this to be ‘personal data’, which means individuals would have to consent to its use. A combination of name and date of birth is another alternative, but this would need to be provided by the individual and studies by the Information Commissioner’s Office show increasing resistance, with nearly 90 per cent of consumers objecting to being asked for too many personal details.

Overall, it looks like data controllers are going to have to get a whole lot more persuasive if they want to pick up PINs.