What qualifies information to be labeled "personal" rather than "sensitive"?

The criteria for labeling information as "personal" rather than "sensitive" revolves around the potential for harm or risk if the information were to be disclosed. A name on its own is considered personal information because it identifies an individual. However, it does not inherently expose the individual to significant risk, making it less sensitive compared to other combinations of information.

When information like a name is paired with an address, a phone number, or especially a social security number, it begins to shift into a sensitive category. For instance, including an address can allow for location-specific identification, while a social security number can be used for identity theft. These combinations possess higher risks and consequences, thus categorizing them as sensitive. Therefore, a name alone appropriately qualifies as personal information due to its identification role without amplifying the vulnerability associated with additional identifiers.