E.U. Regulator Says IP Addresses Are Personal Data

NewsCloud writes "Germany's data-protection commissioner, Peter Scharr told a European Parliament hearing on online data protection that when someone is identified by an IP, or Internet protocol, address, 'then it has to be regarded as personal data.' Scharr acknowledged that IP addresses for a computer may not always be personal or linked to an individual. If the E.U. rules that IP addresses are personal, then it could regulate the way search engines record this data. According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search."

Is a license plate personal data?

[by Anonymous Coward]

Because that's today's car analogy for an IP address.

Re:Is a license plate personal data?

[Respawner (607254)]

actually, if you're using it to identify somebody, or if you keep it as general information about somebody(access log), then yes, yes it is
just like a social security number is personal data, or the number on your id-card or your home-address and so on
ooh yeah, don't confuse US-law with EU-law ;)
and offcourse, IANAL

Re:

[Nullav (1053766)]

Yes, a license plate won't end up on a car six miles away in a matter of months/years. (Hours in the case of dial-up.)

Re:

[barocco (1168573)]

Don't quite agree... I don't think when you pull into the pharmacy to 'GET' a small-size condom you need to utter your license plate number to initiate a conversation & transaction with the cashier (well, in which case you'd probably avoid any conversation but just have the transaction done).

Re:

[LordSnooty (853791)]

Yup, in my country whenever a car is shown on a news report for example they blur out the registration number. This is in line with data protection legislation of the late 90s.

He's totally right

[smitty_one_each (243267)]

Now bow to your Redmond overlord, miscreants! [theonion.com]

Re:He's totally right

[unlametheweak (1102159)]

Don't believe everything you read. The Onion has about as much credibility with me as Fox News.

Re:He's totally right

[packeteer (566398)]

Lies! Not only is fox fair and balanced but the Onion is "America's finest news source."

doubtful

[no-body (127863)]

if the flood of greed to tracking ($$'s) everyone's move can still be held back:

In email source:

HTML comment tag open [WEBTRENDS-Tracking] HTML comment tag close

img alt="DCSIMG" id="DCSIMG" width="1" height="1" src="http://statse.webtrendslive.com/dcskvlalu100004rfxyw......

Strange idea

[geek (5680)]

Never really looked at it this way. I think it's become ingrained in us that IP's are a way of tracking instead of a way of communicating. Being able to track them is just a side issue. If we look at an IP as a means of communication then does that not make it private in some way? I don't know exactly how I feel about this but I'd certainly like to have more rights rather than less of them.

Re:Strange idea

[Amorymeltzer (1213818)]

I always visualized it akin to your telephone number - yeah, it's your number, but anyone can look it up in the pages. You work a bit to get on the no-call list and taken out of the directory, and of course, you can change your number or hide it from caller ID.

Doesn't quite work as an analogy

[CaptainZapp (182233)]

yeah, it's your number, but anyone can look it up in the pages

While everybody can check a directory such directories don't exist for IP numbers. Respectively the information needs to be obtained from the ISP.

I never heard of the requirement of a court order before checking a phone directory.

So...

[.deepershade (994429)]

Does that mean that if passed, then the RIAA can't use my personal data 'IP' to sue me? TFA was a little short on details of the reprecushions of this.

Re:

[mr_matticus (928346)]

No. They'll still use your IP to sue you, just like they'd use your license plate to find you if you ran someone over with your car, or the registered customer of your cell phone if you made threatening calls.

This has potential implications for how easy it will be for them to get your IP and may legitimize some obfuscation methods.

Just like Target doesn't keep a list of all the phone numbers of customers that come in or out, websites you visit will now have to use a higher standard of care with your IP. T

Re:So...

[alx5000 (896642)]

There's no European equivalent to RIAA... maybe there's such an organization on a country level, but I can assure you that sharing is completely legal in Spain, since fair use covers any kind of private copy, no matter whether you own the original or not (and yes, P2P falls into that category).

Re:

[SharpFang (651121)]

In Poland, there's such an organization, ZAIKS. They request the IP-physical address mappings from the ISPs before sending the police to raid the people. ISPs are in no way obligated to give them the info, or withhold it - but since ZAIKS coperates with the Police, ISPs usually yield, just not to anger the Police - they can't really hurt them, but they can make their life more difficult, so the ISPs usually hand over the info.

Now with this decision in effect, ZAIKS would still sue you for copyright violatio

Re:

[smitty_one_each (243267)]

Seeing as how the VP is such a VIP, shouldn't we keep the PC on the QT? 'Cause if it leaks to the VC he could end up MIA, and then we'd all be put out in KP

And they plan to implement this how?!

[CaptainPatent (1087643)]

The only way to check and see if your IP is being kept is by changing the protocol entirely or by checking the company's servers. I'm guessing that not too many companies would appreciate people routinely rooting around, and if something to check if an IP is stored were to be implemented, the protocol would have to be vastly overhauled and it could slow down the internet 80% or more because of the extra time needed to "check."

The bottom line is this is much like the ruling in the US that companies had to keep a record of working memory (which is entirely impossible,) This seems to be more legislators talking about something they know very little about.

Don't get me wrong, I do appreciate the fact that it would make it harder for the ad industry to hunt you down which is always appreciated, I just don't think any reasonable implementation will work.

Re:

[alx5000 (896642)]

And, yes, while we're at it, let's not prosecute fiscal fraud (since it's so hard to check the company's books, and not too many companies want theirs scrutinized).

The same can be applied to websites collecting info on users to sell it to spammers. It's really, really (really!) hard to prove they've sold it, but that wouldn't stop legislators from sanctioning that law, would it?

If the EU passes a law that adds IP addresses to the list of protected private data, that only means it is illegal to collect them

Re:

[unlametheweak (1102159)]

The real issue would be how any privacy protections like storing IPs would be enforced. It is doubtful that a company would willfully admit to storing IPs if it is against the law to do so. I know if I were running a server (Web, FTP, IRC, etc), then I would store IPs despite the law, just because it makes sense from a security perspective (I would want to know who is online, who to ban, etc).

IP's contain less value over time (most consumers have dynamic IP's, can switch ISPs, use proxies, etc), so storing

Re:

[dleigh (994882)]

TFA (and some slashdot readers) seem to be assuming that he is calling for a ban on logging IPs. TFA is pretty thin on what was actually said at the meeting, just taking the assumption and asking a few search company spokespeople for their opinion on that assumption. The comissioner doesn't seem to be claiming anywhere that IP addresses should not be stored, or that regulators should check to see if they are not stored, or that any "implementation" of anything is or should be required. The only statement f

Re:

[thannine (576719)]

The comissioner doesn't seem to be claiming anywhere that IP addresses should not be stored, or that regulators should check to see if they are not stored, or that any "implementation" of anything is or should be required. The only statement from him seems to boil down to "something which identifies a person should be considered personal data".

And this would be the logical thing to say. Many posters have been wondering "how are they going to implement this?". Well, the thing is that laws like that are already in place (at least in Finland, but I'm assuming the rest of EU also), it's just the question of whether they apply to IP addresses as well as phone numbers, addresses, social security numbers etc. It's not illegal as such to store those, it's just regulated.

Re:And they plan to implement this how?!

[mxs (42717)]

You misunderstand the issue. If IP addresses are considered personal data, they can still be used during the connection and for tasks immediately related to servicing that connection -- akin to buying something with your credit card (which does not allow the store to store your personal information for purposes other than payment processing).

In Germany's current privacy and data protection laws, everybody has the right to decide what happens to their own personal information if it is being processed by computers. For instance, you can tell Amazon to delete all personally identifiable data they have about you, and they have to comply -- and you can ask any company that has personal data about you (such as your phone number, your address, etc. in telemarketing and plain old snailmail spam) to tell you where they got it from, what basis they have for keeping it, and to delete it from their databases. If they do not comply, you have a strong legal standing to compel them to give out this information (Mr. Sharr, who is quoted here, is the national representative for data protection, though there are more local ones as well -- if they suspect foul play, they /can/ raid businesses, and do so if warranted.

The legislators know very well what they are talking about. The scope of "personal data" is narrowly confined (anything that can be used to identify you or is saved in relation to data that can personally identify you or anything that could automatically be tied to you by a third party; IP addresses fall into the latter category; while a webhost will not be able to do the IP -> Name&Address resolution, the user's ISP could -- therefore the IP address is personally identifiable to a specific party through a third party and thus personal data protected under stringent data protection laws. This has been tested in court (the German DoJ, for instance, is no longer allowed to log IP addresses on their web servers by court order).

These laws don't "just" exist to combat the ad industry, but rather are an extension of one of our constitutions human rights, that is, the right to free self expression; this includes, under German law, the right to decide what happens to your data. There are, of course, certain restrictions (for instance, the DMV can process this data, as can other governmental bodies -- IF SPECIFICALLY AFFORDED THAT RIGHT BY LAW -- for their (narrow) purposes. You can waive this right (i.e. you can give your address to Reader's Digest for them to spam you with as they see fit -- if you give the permission (which is always revocable), they can do with your data whatever you allowed them to; Sweepstakes, for instance, are often designed to gather this data and get permission).

As for implementation thereof : I don't see a problem. The ip address can still be used to commmunicate same as before; it just can't be logged indefinitely nor used for purposes other than the intended one (i.e. connection establishment, communication, teardown vs. ad tracking) UNLESS the person in question has given permission. What this boils down to in Apache is adding mod_removeip. If no other information personally identifies your visitors (even through a third party), you can now log this data and do with it as you wish. Another possibility would be pseudonymizing the IP addresses with one-way hashes (though some care will have to be taken that this is not reversible easily, which may become a problem since there are only 32 bits in an IP address and thus bruteforcing is a viable tactic).

Nothing needs to be implemented to "check" whether the IP is stored. If you have a reasonable assumption that your contract partner is screwing you over, you can lodge a complaint with the Landesdatenschutzbeauftragter or Bundesdatenschutzbeauftragter (Mr. Scharr in this case), who will investigate -- same as when you suspect they are selling your address information illegally or engage in other illegal activites.

I for one am glad that there are some privacy advocates who thing about this s

Re:

[pipatron (966506)]

Without some form of [at least somewhat] verifiable logs, there is no record proving that real users were ever shown the ads.

Great! This would mean that there's no ads on television, because such a model could never work. I guess I stopped watching TV because I'm crazy and see things that doesn't exist then.

Re:

[Fastolfe (1470)]

Web ads are not billed based on placement, with the "hope" that some number of eyeballs will see it. Web ads are billed based on the number of impressions or clicks. SOX is a HUGE deal for these types of arrangements. If you're suggesting that web ads move to the TV ads model, that's a fairly significant change and I'm not really sure that would work out very well. You'd need some sort of awkward payment schedule for the millions of tiny sites out there that generate just enough traffic for a few bucks

Re:

[Yvanhoe (564877)]

Germans learned from nazism and sovietism that privacy was a damn serious issue. That any entity with personal information about several million people can turn into something nasty. They completely understand how IP logs could be used in a bad way, Americans tend to be optimistic about this but Germans already have undergone two periods of oppression that relied on an extensive invasion of privacy.

Just Addresses

[excelblue (739986)]

I am truly disappointed in this. If IP addresses are a means of communications, wouldn't that be similar to phone numbers?

It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here.

Re:

[davetpa (1109467)]

It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here.

But what about if the phone company sells your phone number (no other information attached) along with a record of all the numbers you called and all the numbers that called you? Now your phone number is no longer just a means of communication.

The scary part is that they've been doing that for years WITH your other personal information!

Re:

[SnowZero (92219)]

But what about if the phone company sells your phone number (no other information attached) along with a record of all the numbers you called and all the numbers that called you? Now your phone number is no longer just a means of communication.

I would say that we need laws that differentiate between storing and selling?

I don't care if Joe the barber keeps a record of all the appointments I've ever made with him, and the phone number I used to make each appointment. What I do care about is that he does not give away or sell this information, and that he uses due diligence to protect the information from being stolen.

Anything else is getting far too close to a world like 1984, where keeping a diary can become illegal.

Re:

[Harmonious Botch (921977)]

Or is my street address personal data? Or how about "the girl next door"? That is a unique identifier too.

Re:Just Addresses

[mr_matticus (928346)]

Yeah.

That's exactly what's going on. Your phone number is personal data, too.

I don't understand the source of your disappointment, unless you think that personal data is private information. It's not.

Re:Just Addresses

[Beriaru (954082)]

Your name is personal data, but not private.
Your phone number is personal data, but not private.
Your Address is personal data, but not private.
And of course, your IP is not private... but is part of your personal data.

Maybe in USA there is no difference between private and personal data, but in EU there's a big difference: nobody can NOT store your personal data without warning you and giving methods to correct AND ERASE your data.

Re:Just Addresses

[QuantumG (50515)]

nobody can NOT store your personal data without warning you

Well shit, I better warn you right now that I'm not storing your personal data.. that goes for everyone else reading this: I AM NOT STORING YOUR PERSONAL DATA!

Whew, lucky I got that out of the way.

Re:

[Tavor (845700)]

Indeed. Should us Americans use a similar setup, I believe the RIAA would not be able to do it's I.P. address drift-net tactics. Though, as always, IANAL. Though I would love to hear NYCL's take on it.

Re:

[neoform (551705)]

I'd say it's more like a home address. Would you get in trouble for writing down someone's address? Why should an IP address be any more 'personal'? I'd say both are quite impersonal.

Whoa

[MattPat (852615)]

I can't believe what I'm seeing. Is this actually a semi-responsible technology-related decision made by a legislative body?

I'm not saying I necessarily agree with the complete "scrubbing" of Google et al.'s records, as it were, but the classification of an IP address as personally-identifiable information is definitely a positive step towards Internet freedom, and a reasonable expectation of some degree of privacy. At the very least, it gives you a leg to stand on when you find out that some company has

Trust Microsoft

[Doc Ruby (173196)]

According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search.

Unless Microsoft is just lying. How can they be trusted, with their track record?

Ok, more craziness

[Psychotria (953670)]

How is an IP address more "personal" than my GPS location at any given point in time? Sure an IP address can be "mine" if I have my own domain etc. This is not usually the case though. Most IP addresses are "owned" by the ISP and assigned to people via DHCP (except for static ones). This is not too much unlike a restaurant reserving tables for a customer, and sometimes reserving a table for a customer for a long time. It doesn't make the table being reserved the customers the customers personal property; the restaurant still owns it--it is no more personal than, well, any other table in an anonymous bar (for example). I can't see how IP addresses can be "personal".

Re:

[mxs (42717)]

How about IP address + timestamp ?

Your address ISP Webhost IP + Timestamp GET /hot/brunette/doing/funky/stuff/naked/001.jpg --> Your address --> GET /hot/brunette/doing/funky/stuff/naked/001.jpg (and that is personal data since it identifies you as a person doing something.

Re:

[Psychotria (953670)]

Yeah; your IP address still isn't private though, so I stand by my original argument. There are ways to get around that of course.

Re:

[mxs (42717)]

Your original argument was "personal data" not "private data". There is a difference. It's not about hiding your personal data, it's your right to decide what happens to your personal data -- in particular whether it can be used for stuff other than the purpose you intended, legally.

Begs the question...

[creimer (824291)]

If IP addresses are personal data, who owns 127.0.0.1?

Re:Begs the question...

[lexarius (560925)]

Well, that's my computer's IP address, so it's obviously mine, and I'll have to ask you to stop waving it around like that.

Re:

[jroysdon (201893)]

Same guy that owns ::1 [hp.com]

Major legal issues arising?

[DigitAl56K (805623)]

If IP addresses are personal data, and you visit my web page, and my access logs show I served an IP that you used at a certain time (or even just that I served an IP you used), am I now subject to laws regarding the holding of personal information? If you were to contact me and request that information how would I authenticate you? If I was to disclose certain parts of the "personal data" that you claimed belonged to you, how could I know that I was not disclosing someone else's personal information, given that I can't necessarily authenticate you or anyone else and IP's can be re-allocated? If I ban an IP address for abusing my server and it is later re-allocated to someone else, is that slander? If I forward an e-mail whose headers contain IP addresses of relay servers, is that unlawful disclosure of personal information?

This is totally ridiculous.

Re:

[arkhan_jg (618674)]

You're assuming the restrictions on personal data are greater than they are. If IP's are judged personal data, that makes them like a telephone number or an address (The Act covers any data which can be used to identify a living person). Still, you do have some responsibilities, *if you're in the EU* with regards handling personal data. Basically, there are restrictions on publishing it or sharing it around without permission, and you can only use it for the original purpose for which it was collected. (Sen

It's Peter SCHAAR

[Doctor O (549663)]

His name is Peter Schaar, not Scharr. One would think the editors would at least *skim* TFA.

Oh, and he's a great guy BTW, responding to email in a timely and thoughtful manner, and investigating the questions he's being asked.

How will this affect Wikipedia?

[ta bu shi da yu (687699)]

Wikipedia records IP addresses for all anonymous editors. I wonder how this will affect the project?

Re:

[Your.Master (1088569)]

The report isn't released yet. It's from an EU regulator. These guys aren't noted for being particularly sympathetic toward Microsoft. This sort of question is kind of tinfoil-hattish.

Look at the privacy policies of Microsoft and Google. Search them out yourself. Google them, or live search them if you don't want your IP logged. MS's official position on privacy is generally fairly strict, and they consider it a selling point. Google's is less so, and they consider it a non-issue.

If you disbelieve th

Re:

[Kamokazi (1080091)]

With a statement like that I really doubt you'd even believe it coming from your own mother holding a document signed by Bill Gates and notorized by a Supreme Court judge. Because, you know, Microsoft doing something better than Google completely contradicts the Slashdot Theory of Logic.