While performing a security review for a new product, an information security professional discovers that the organization's product development team is proposing to collect government- issued identif

Using a variant of the government-issued ID number still exposes sensitive PII because a variant (e.g., last four digits or a transposition) can often be reverse-engineered or correlated back to the original government ID, defeating the purpose of separation.

Creating customer identifiers that bear no resemblance to government-issued ID numbers follows the privacy principle of data minimization and separation - the internal identifier should be a system-generated opaque token (e.g., UUID) with no relationship to the sensitive PII. This prevents attackers or insiders from inferring, reconstructing, or correlating the government ID from the customer identifier, and limits the blast radius of a data breach by ensuring the identifier itself carries no sensitive information.

While cryptographic hashing is better than storing the raw ID, hash-based identifiers derived from government IDs are still considered sensitive because government IDs have low entropy and are vulnerable to precomputation or rainbow table attacks, and the hash still functionally ties the identifier to the PII.

Name-based identifiers like 'jdoe' expose personally identifiable information (the user's name) in the identifier itself, violate data minimization principles, and create enumeration and identity-guessing risks without providing any protection for the underlying government ID.