# Personal Information Classification on Aggregated Android Application's Permissions
## 2 Related Work  
### Personal Information and Privacy  
Personal data is something that reveals an individual's identity or features. PII is a popular jargon used in the USA, Korea and Australia [46]. The European Union uses 'personal information' [47]. The National Institute of Standards and Technology (NIST) [48] defines PII as _\"any information about an individual maintained by an agency, including (PII) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (linked PII or PPII) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information\"_. Studies [49; 50; 51] have also mentioned that a combination of partial identities can produce a full identity. Therefore, throughout the study, partial identity and PPII were considered as a similar object. [48; 50; 51; 49] defined partial identity or PPII as \"_A partial identity is a subset of attribute values of a complete identity, where a complete identity is the union of all attribute values of all identities of this person_\". Table 1 shows a few examples of PII and PPII [52; 37; 46; 53]. De-identification (Did) is a method by which information is modified in a way that data can no longer directly or indirectly indicate an identity. After the Did, the data is known as non-personally identifiable information (NPII). The data that is unable to distinguish any identity individually is NPII (shareable and risk-free information). Australian privacy law and practice [54] defines it as _\"non-identifiable data, which have never been labeled with individual identifiers or from which identifiers have been permanently removed, and by means of which no specific individual can be identified. A subset of nonidentifiable data is those that can be linked with other data, so it can be known that they are about the same data subject, although the person's identity remains unknown\"_. Finally, re-identification (Rid) of personal data is done by matching the anonymous identities with available partial information to expose the exact identity of the data owner [55]. In the Android ecosystem, app owners (publisher and owner) Rid user data in order to generate app user's unique identity. Our previous works [35; 37; 56] have already stated, Android app permissions affect PII. Beside phones, permissions are being collected by the apps run on a smart vehicle, TV, smart car, smart toys, Internet of Things (IoT) device, etc.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**PII** & **PPII** \\ \hline Full name and home address, biological identities, contact number, full email address, national identification number, passport number, social security number, taxpayer number, patient identification data, Iris data, fingerprints, credit card info, digital identity & Partial birthdate, part of a name, state or city, job status, web cookie, few digits of SSN, employment info, medical info, blood pressure data, education status, financial info, religion, supported team, postal code, music choice, IP address, place of birth, political view, race & Partial birthdate, part of a