Personally identifiable information, or PII, is pretty intuitive. If you know someone's phone, Social Security number or credit card number, you have a direct link to their identity.

Hackers use these identifiers, along with a few more personal details, as keys to unlock data, steal identities, and ultimately take money. The lines between PII and non-PII data are blurring. It's been known for at least 10 years that there are specific pieces of data which may appear anonymous, but when they're taken together are just as effective at identifying a person as traditional PII.

The easiest to understand of these so called quasi-PIIs is the trio of full birth date, ZIP code and gender. If a company had published a dataset that had been "de-identified" by removing all the standard PIIs, but left those three data items alone, a smart hacker could with very high likelihood find the name and address of the person behind that data.