E.U. Regulator Says IP Addresses Are Personal Data 164
NewsCloud writes "Germany's data-protection commissioner, Peter Scharr told a European Parliament hearing on online data protection that when someone is identified by an IP, or Internet protocol, address, 'then it has to be regarded as personal data.' Scharr acknowledged that IP addresses for a computer may not always be personal or linked to an individual. If the E.U. rules that IP addresses are personal, then it could regulate the way search engines record this data. According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search."
Is a license plate personal data? (Score:5, Insightful)
Re:Is a license plate personal data? (Score:4, Insightful)
just like a social security number is personal data, or the number on your id-card or your home-address and so on
ooh yeah, don't confuse US-law with EU-law
and offcourse, IANAL
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
He's totally right (Score:5, Funny)
Re:He's totally right (Score:5, Funny)
Re:He's totally right (Score:5, Funny)
Re: (Score:2)
Do go on, sir.
That's insulting! (Score:2)
doubtful (Score:2)
In email source:
HTML comment tag open [WEBTRENDS-Tracking] HTML comment tag close
img alt="DCSIMG" id="DCSIMG" width="1" height="1" src="http://statse.webtrendslive.com/dcskvlalu100004rfxyw......
Re: (Score:2)
Strange idea (Score:4, Interesting)
Re:Strange idea (Score:5, Insightful)
Doesn't quite work as an analogy (Score:3, Insightful)
While everybody can check a directory such directories don't exist for IP numbers. Respectively the information needs to be obtained from the ISP.
I never heard of the requirement of a court order before checking a phone directory.
Re: (Score:2)
I'm also always leery of legislating on technology- it has the funny e
So... (Score:3, Interesting)
Re: (Score:2)
This has potential implications for how easy it will be for them to get your IP and may legitimize some obfuscation methods.
Just like Target doesn't keep a list of all the phone numbers of customers that come in or out, websites you visit will now have to use a higher standard of care with your IP. T
Re:So... (Score:5, Informative)
Re: (Score:2)
Re: (Score:3, Interesting)
Now with this decision in effect, ZAIKS would still sue you for copyright violatio
Re: (Score:2)
And they plan to implement this how?! (Score:5, Informative)
The bottom line is this is much like the ruling in the US that companies had to keep a record of working memory (which is entirely impossible,) This seems to be more legislators talking about something they know very little about.
Don't get me wrong, I do appreciate the fact that it would make it harder for the ad industry to hunt you down which is always appreciated, I just don't think any reasonable implementation will work.
Re: (Score:2, Informative)
The same can be applied to websites collecting info on users to sell it to spammers. It's really, really (really!) hard to prove they've sold it, but that wouldn't stop legislators from sanctioning that law, would it?
If the EU passes a law that adds IP addresses to the list of protected private data, that only means it is illegal to collect them
Re: (Score:3, Insightful)
IP's contain less value over time (most consumers have dynamic IP's, can switch ISPs, use proxies, etc), so storing
Re: (Score:3, Informative)
Re: (Score:2, Informative)
The comissioner doesn't seem to be claiming anywhere that IP addresses should not be stored, or that regulators should check to see if they are not stored, or that any "implementation" of anything is or should be required. The only statement from him seems to boil down to "something which identifies a person should be considered personal data".
And this would be the logical thing to say. Many posters have been wondering "how are they going to implement this?". Well, the thing is that laws like that are already in place (at least in Finland, but I'm assuming the rest of EU also), it's just the question of whether they apply to IP addresses as well as phone numbers, addresses, social security numbers etc. It's not illegal as such to store those, it's just regulated.
Re:And they plan to implement this how?! (Score:5, Insightful)
In Germany's current privacy and data protection laws, everybody has the right to decide what happens to their own personal information if it is being processed by computers. For instance, you can tell Amazon to delete all personally identifiable data they have about you, and they have to comply -- and you can ask any company that has personal data about you (such as your phone number, your address, etc. in telemarketing and plain old snailmail spam) to tell you where they got it from, what basis they have for keeping it, and to delete it from their databases. If they do not comply, you have a strong legal standing to compel them to give out this information (Mr. Sharr, who is quoted here, is the national representative for data protection, though there are more local ones as well -- if they suspect foul play, they
The legislators know very well what they are talking about. The scope of "personal data" is narrowly confined (anything that can be used to identify you or is saved in relation to data that can personally identify you or anything that could automatically be tied to you by a third party; IP addresses fall into the latter category; while a webhost will not be able to do the IP -> Name&Address resolution, the user's ISP could -- therefore the IP address is personally identifiable to a specific party through a third party and thus personal data protected under stringent data protection laws. This has been tested in court (the German DoJ, for instance, is no longer allowed to log IP addresses on their web servers by court order).
These laws don't "just" exist to combat the ad industry, but rather are an extension of one of our constitutions human rights, that is, the right to free self expression; this includes, under German law, the right to decide what happens to your data. There are, of course, certain restrictions (for instance, the DMV can process this data, as can other governmental bodies -- IF SPECIFICALLY AFFORDED THAT RIGHT BY LAW -- for their (narrow) purposes. You can waive this right (i.e. you can give your address to Reader's Digest for them to spam you with as they see fit -- if you give the permission (which is always revocable), they can do with your data whatever you allowed them to; Sweepstakes, for instance, are often designed to gather this data and get permission).
As for implementation thereof : I don't see a problem. The ip address can still be used to commmunicate same as before; it just can't be logged indefinitely nor used for purposes other than the intended one (i.e. connection establishment, communication, teardown vs. ad tracking) UNLESS the person in question has given permission. What this boils down to in Apache is adding mod_removeip. If no other information personally identifies your visitors (even through a third party), you can now log this data and do with it as you wish. Another possibility would be pseudonymizing the IP addresses with one-way hashes (though some care will have to be taken that this is not reversible easily, which may become a problem since there are only 32 bits in an IP address and thus bruteforcing is a viable tactic).
Nothing needs to be implemented to "check" whether the IP is stored. If you have a reasonable assumption that your contract partner is screwing you over, you can lodge a complaint with the Landesdatenschutzbeauftragter or Bundesdatenschutzbeauftragter (Mr. Scharr in this case), who will investigate -- same as when you suspect they are selling your address information illegally or engage in other illegal activites.
I for one am glad that there are some privacy advocates who thing about this s
worry about the German government first (Score:2, Informative)
Well, that is, except for all the ways in which the German government uses that information to track you and spy on you. German privacy attitudes are schizophrenic: they live in a country with a history of governments perpetrating genocidal mass murder based, in large part, on personal information and connections between citizens. You
Re: (Score:3, Insightful)
Re: (Score:2)
Well, apparently Germans didn't learn:
http://www.heise.de/newsticker/meldung/98747 [heise.de]
http://www.tagesschau.de/inland/vorratsdatenspeicherung22.html [tagesschau.de]
Americans tend to be optimistic about this
Optimistic? Americans are deeply distrustful of their government and protective of their ability to remain anonymous, far more than Germans.
but
Re: (Score:2)
That's why, in this context, the approach on topics such as mandatory ID's strikes me as strange in the two countries.
Most of the European countries, especially those that used to be behind the Iron Curtain, have grown used to mandatory ID's. When they finally got a taste of actual freedom and democracy they kept the ID's, but they also payed a lot more
Re: (Score:2)
Re: (Score:2)
This is quite incorrect. In the US and other nations, you can get a phone for cash or with just a credit card number (and you can get anonymous credit cards if you like). In Germany, you need to give your home address to the carrier, because of government regulations. This is one of the reasons getting a Skype number in Germany is such a problem.
(In addition, in Germany, your home address its
Re: (Score:2)
No, I do not need to pay a fee to leave that field blank. It is also quite common NOT to have that field filled out, after all, having it filled out means that y
Re: (Score:2)
The law applies to all phones: land line, Internet, and cell phones.
No, I do not need to pay a fee to leave that field blank.
You can't "leave" that field blank; that field is filled in automatically on your tax forms every year unless you take explicit action. In order to change it, you need to explicitly file a form with the government, and there's a fee associated with that. http://www.kirchenaustritt.de/ [kirchenaustritt.de]
And no, the police does not have acce
Re: (Score:2)
As for change of affiliation costing a fee, you seem to be correct for some states. I did not have to pay anything when I did it, since I'm in one of those states where it does not cost anything.
Sources would be the BDSG (Bundesdatenschutzgesetz). Per
Re: (Score:2)
http://www.gesetze-im-internet.de/bdsg_1990/BJNR029550990.html [gesetze-im-internet.de]
In 14(2)(6), 14(2)(7), and 14(5)(1), that law effectively permits the use personal data collected by any government agency for police purposes, including highly personal information, like religion and sexuality. That's in addition to several other loopholes in that law th
Re: (Score:2)
Re: (Score:2)
Section 14 doesn't talk about data collection at all; it talks about how government agencies can use data already collected by other agencies for new purposes. And evidently they do.
Neither 14(2)(6) nor 14(2)(7) apply without cause ("Präventive Strafverfolgung" in and of itself is not allowed as per PolG, "Straftatprävention" has to meet a proportionality-test as it affects article 2 GG).
You claimed that the
Re: (Score:2)
I claimed police could ge the data under lawful order from a judge, not that it was impossible for them to get it. In retrospect (while this does apply to private entity data collection), that was too strong a statement. There are, however, restrictions and usage-bound rules. It has been a while since I studied th
Re: (Score:2)
Where do you think modern German values come from? Post-WWII Germany was shaped by the victors of WWII, its constitution was written under US supervision, it was de-nazified and re-educated under allied control, and Germany was integrated into a complex web of economic and military relationships. In fact, you might say that today's Germany is
Re: (Score:2)
Re: (Score:2)
I didn't claim that Germany society was a carbon copy of the US, I said that German democratic values and traditions are largely derived from American ones (which are basically the same as the allied ones).
but no, democracy existed in these parts before it, with tradition.
Really? Like where? German intellectuals liked to talk a lot
Re: (Score:2)
The state of a society is influenced by its history, but you cannot derive its state thereof; That would require a mighty crystal ball (i.e. in how history is interpreted and used in that society). There are of course some ways do gauge the general trends in a society (pollsters make their living doing that, and some even have a scientific foundation). I couldn't paint a picture of
Re: (Score:2)
Neither can I. But I'm not saying that Germany is a bad democracy, I'm disagreeing with you that the world should look to Germany as a model of privacy protection and democracy. Germany has not faced a major crisis change since WWII, so nobody knows how it would hold up.
That's where stuff is going awry, IMHO. If that is how DEMOCRACY should work, then it is not democracy we are talking
Re: (Score:2)
Re: (Score:2)
Where do you get that from? Of course, his testimony should be heard. I'm saying people need to look at his and Germany's record and not just believe the German myth that Germany has strong data protection laws.
I find it interesting that you seem to consider low voter turnout a good thing, and the reason given for it.
Where do you get that from? I said "Voter turnou
Re: (Score:2)
So you did not imply for the EU and the US to tell him to go take a hike, get his house in order first before he can make a valid point one should listen to ?
Where do you get that from? I said "Voter turnout tells you little about the health of a democracy. The relatively low voter turnout in the US
Re: (Score:2)
Great! This would mean that there's no ads on television, because such a model could never work. I guess I stopped watching TV because I'm crazy and see things that doesn't exist then.
Re: (Score:2)
Re: (Score:2)
That's an idiotic opinion. If you find a way to block ads, then it doesn't matter either way; if not, at least personalized ads will be personalized. Your fear of them 'tracking you down' is irrational, as if you think they're kidnappers or something.
Re: (Score:2)
I doubt they will systematically check companies, but rather when something does t
Just Addresses (Score:5, Insightful)
It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here.
Re: (Score:2, Insightful)
It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here.
But what about if the phone company sells your phone number (no other information attached) along with a record of all the numbers you called and all the numbers that called you? Now your phone number is no longer just a means of communication.
The scary part is that they've been doing that for years WITH your other personal information!
Re: (Score:2)
But what about if the phone company sells your phone number (no other information attached) along with a record of all the numbers you called and all the numbers that called you? Now your phone number is no longer just a means of communication.
I would say that we need laws that differentiate between storing and selling?
I don't care if Joe the barber keeps a record of all the appointments I've ever made with him, and the phone number I used to make each appointment. What I do care about is that he does not give away or sell this information, and that he uses due diligence to protect the information from being stolen.
Anything else is getting far too close to a world like 1984, where keeping a diary can become illegal.
Re: (Score:2)
The use you hypothetical Joe the barber would put your telephone number to is exactly within the scope of the EU privacy directive upon which German law is based. Joe must tell you what info he stores, and what use he puts it to. If that use is vital to his business relationship with you, it is allowed. All other uses need your specific consent.
So Joe can store your appointment information. Without your consent, he may have to remove all telephone numbers except on the latest appointment. He can most defin
Re: (Score:2)
Re: (Score:2)
Re:Just Addresses (Score:5, Insightful)
That's exactly what's going on. Your phone number is personal data, too.
I don't understand the source of your disappointment, unless you think that personal data is private information. It's not.
Re:Just Addresses (Score:5, Informative)
Your phone number is personal data, but not private.
Your Address is personal data, but not private.
And of course, your IP is not private... but is part of your personal data.
Maybe in USA there is no difference between private and personal data, but in EU there's a big difference: nobody can NOT store your personal data without warning you and giving methods to correct AND ERASE your data.
Re:Just Addresses (Score:5, Funny)
Whew, lucky I got that out of the way.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I expect you can s/European/Australian/ in that.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Whoa (Score:2)
I can't believe what I'm seeing. Is this actually a semi-responsible technology-related decision made by a legislative body?
I'm not saying I necessarily agree with the complete "scrubbing" of Google et al.'s records, as it were, but the classification of an IP address as personally-identifiable information is definitely a positive step towards Internet freedom, and a reasonable expectation of some degree of privacy. At the very least, it gives you a leg to stand on when you find out that some company has
Trust Microsoft (Score:4, Interesting)
Unless Microsoft is just lying. How can they be trusted, with their track record?
Re: (Score:2)
50% Interesting
30% Insightful
20% Flamebait
At least 20% of modders trust Microsoft more than their own lying eyes.
Ok, more craziness (Score:3, Interesting)
Re: (Score:2)
Your address ISP Webhost IP + Timestamp GET
Re: (Score:2)
Re: (Score:2)
Begs the question... (Score:3, Interesting)
Re:Begs the question... (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
I had it first!
Major legal issues arising? (Score:3, Interesting)
This is totally ridiculous.
Re: (Score:3, Informative)
Re: (Score:2)
IP addresses are personal data... (Score:2)
Germany's positions on issues of privacy are rather two-faced, having one of the most intrusive surveillance states in the world, while at the same time proclaiming itself to defend personal freedoms.
It's Peter SCHAAR (Score:4, Informative)
Oh, and he's a great guy BTW, responding to email in a timely and thoughtful manner, and investigating the questions he's being asked.
Re: (Score:2)
And the posting is correctly tagged as concerning schaar, not scharr[1].
I know, because I tagged it as such, and I guess several others followed me in this, either because they're German and know Mr Schaar, too, or because they've read my comment.
I think Peter Schaar's name stems from Schar, which means group of people.
Might be, then again I went to school with someone whose name was also Schaar, and he told me it was of Dutch origin and had to do with some medieval profession, but I don't remember which it was. Maybe someone from Benelux can elaborate. ;)
How will this affect Wikipedia? (Score:3, Insightful)
Re: (Score:2)
1) Wikipedia is US based so these laws do not apply (they do not have the data protection act)
2) Wikipedia states on it's edit screen that everything you submit will be covered by the GNU Free Documentation Licence and so the people who IP address have been logged have voluntarily given up their rights by submitting
Re: (Score:2)
http://news.bbc.co.uk/1/hi/7196803.stm [bbc.co.uk]
However, regardless of where a company is based, the link above suggests if they're "established" in the UK they're subject to law in the UK (presumably the law of whichever bit of the UK they're established in). Presumably it is up to a court has to establish that. In the case of someone with an actual ad
Data Protection (Score:2, Insightful)
Yahoo Germany Helpdesk (Score:2, Funny)
Caller: "Yes, I want you to delete all your records with my IP address in it..."
Helpdesk: "OK"
Caller: "and I want you to tell me who gave you my IP address."
Helpdesk: "Umm, well your computer will have sent us your IP address when you connected to the website"
Caller: "Oh, I don't think so, I have a very good firewall."
Helpdesk: "Hello, this the German National Bank Helpdesk"
Caller: "Yes, I want you to delete all your records with my IP address in it
IP addressare NEVER linked to a user (Score:2)
If you read just one comment, read this one. (Score:2)
Second: This is how things have been always been in most of Europe. The commissioner didn't change a ruling, he just said that he agrees with the consensus view. (Of course I don't know what the situation is in every European country, only for the ten or so.)
Personal data doesn't mean private. If fact, in many cases it is the opposite of private. In European practice, an individual has control over their own personal data. To use
Re: (Score:1, Funny)
Re: (Score:3, Insightful)
Look at the privacy policies of Microsoft and Google. Search them out yourself. Google them, or live search them if you don't want your IP logged. MS's official position on privacy is generally fairly strict, and they consider it a selling point. Google's is less so, and they consider it a non-issue.
If you disbelieve th
Re: (Score:2)
Re: (Score:2)
Furthermore, a Press Release is not legally binding. Policies like this *are*
Re: (Score:3, Funny)
Re: (Score:2)