E.U. Regulator Says IP Addresses Are Personal Data

NewsCloud writes "Germany's data-protection commissioner, Peter Scharr told a European Parliament hearing on online data protection that when someone is identified by an IP, or Internet protocol, address, 'then it has to be regarded as personal data.' Scharr acknowledged that IP addresses for a computer may not always be personal or linked to an individual. If the E.U. rules that IP addresses are personal, then it could regulate the way search engines record this data. According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search."

Comments

Is a license plate personal data?

[Anonymous Coward]

Because that's today's car analogy for an IP address.

Re:Is a license plate personal data?

[Respawner]

actually, if you're using it to identify somebody, or if you keep it as general information about somebody(access log), then yes, yes it is
just like a social security number is personal data, or the number on your id-card or your home-address and so on
ooh yeah, don't confuse US-law with EU-law ;)
and offcourse, IANAL

Re:Is a license plate personal data?

[Nullav]

Yes, a license plate won't end up on a car six miles away in a matter of months/years. (Hours in the case of dial-up.)

Re:Is a license plate personal data?

[barocco]

Don't quite agree... I don't think when you pull into the pharmacy to 'GET' a small-size condom you need to utter your license plate number to initiate a conversation & transaction with the cashier (well, in which case you'd probably avoid any conversation but just have the transaction done).

Re:Is a license plate personal data?

[jgeeky]

also, i can't shell into your car from my car and drive it around. or can i? muahahahaha

Re:Is a license plate personal data?

[LordSnooty]

Yup, in my country whenever a car is shown on a news report for example they blur out the registration number. This is in line with data protection legislation of the late 90s.

Re:Is a license plate personal data?

[Anonymous Coward]

I don't think when you pull into the pharmacy to 'GET' a small-size condom you need to utter your license plate number

No, that's only if you want Sudafed.

Re:Is a license plate personal data?

[flashdot1234]

Some of my work is to develop basic services for ISP's. This includes systems that manage the sale and delivery of, say, an ADSL subscription. The system can generate your PPPoE username, and provide it preprogrammed into your modem. Our services include the authentication services that are later used to decide wether you can have access to your service or not. The ISP can access your account, and know what IP address you've had at any point in time. The search can also be reversed, to find out who had a specific IP address at a given point in time.

I have to say, these data are not available to the general public, so in that sense your IP address doesn't say much about your person. The problem arises if the police are given access these data more and more without the need for court orders and such, it becomes easier and easier for them to "interpret" what they find in any direction they'd like.

Let's say my computer got hijacked, and was used in a computer break-in. I get prosecuted for this, and my logs show I've read a lot about computer vulnerabilities. Doesn't look good, does it? Even though the reason for the reading up on vulnerabilities is tied to my work, it becomes pretty easy to paint a completely different picture.

I haven't read TFA, but I at least partially agree that IP addresses are personal data. If you could combine all the logs that exist from your movements online, they have the potential to say quite a lot more about your personal behavior than most people would be comfortable with.

Re:Is a license plate personal data?

[Anonymous Coward]

No, that's only if you want Sudafed.

You buy Sudafed? You must be a drug dealer, as there can be no other rational explanation except to presume you are.

Re:Is a license plate personal data?

[Anonymous Coward]

Not a good analogy -- it's not illegal to take measures to hide your IP address. Yet.

Re:Is a license plate personal data?

[Anonymous Coward]

I think an IP address in many instances is more like the license plate on a bus. Maybe even a family van. But in the next few days it gets randomly assigned to another van in the neighborhood. Nowadays with NAT and all, it would rarely be the license plate on a car used only by one person (though that would still often be true).

Re:Is a license plate personal data?

[malsdavis]

Many IP addresses are static though. I don't really understand what NAT has to do with it in the vast majority of cases.

Re:Is a license plate personal data?

[gallwapa]

Dealer? You insensitive clod! Try cooker!

He's totally right

[smittyoneeach]

Now bow to your Redmond overlord, miscreants!

Re:He's totally right

[unlametheweak]

Don't believe everything you read. The Onion has about as much credibility with me as Fox News.

Re:He's totally right

[packeteer]

Lies! Not only is fox fair and balanced but the Onion is "America's finest news source."

Re:He's totally right

[smittyoneeach]

Are you saying that you can differentiate among any of the cable news channels and an open sewer?
Do go on, sir.

Re:He's totally right

[Fierlo]

At least The Onion gets things right sometimes... http://www.theonion.com/content/node/33930

Citation needed

[Divx]

First of all, where is your proof that microsoft does not keep logs of IP addresses. And which microsoft site? msn.com? live.com?

Re:Citation needed

[Anonymous Coward]

No problem

Re:Citation needed

[Your.Master]

The report isn't released yet. It's from an EU regulator. These guys aren't noted for being particularly sympathetic toward Microsoft. This sort of question is kind of tinfoil-hattish.

Look at the privacy policies of Microsoft and Google. Search them out yourself. Google them, or live search them if you don't want your IP logged. MS's official position on privacy is generally fairly strict, and they consider it a selling point. Google's is less so, and they consider it a non-issue.

If you disbelieve these stated corporate policies, then you really should get in contact with a lawyer and take some action.

Re:Citation needed

[Kamokazi]

With a statement like that I really doubt you'd even believe it coming from your own mother holding a document signed by Bill Gates and notorized by a Supreme Court judge. Because, you know, Microsoft doing something better than Google completely contradicts the Slashdot Theory of Logic.

Re:Citation needed

[GreatBunzinni]

You are being rather silly here. It's one thing for a corporation to offer vague promises in the form of a glorified press release. Having those promises being enforced by law is a whole different thing. How many times have corporations swore to something (Google's "don't do evil", Apple's "laptops should not be used on laps", Microsoft's "we take standards very seriously/ security is our prime objective", etc...) to then see them blatantly breaking their promise?

Re:Citation needed

[Your.Master]

There's a massive difference between "we won't do evil" and "we do not store any passwords granted through site X / we store them for only 1 week, and shred the backups". One is a vague assertion and open to interpretation, and the other is not. And neither Microsoft is not very vague on this fact. Google is more vague, but in some cases does come out and say they make no promise.

Furthermore, a Press Release is not legally binding. Policies like this *are*

doubtful

[no-body]

if the flood of greed to tracking ($$'s) everyone's move can still be held back:

In email source:

HTML comment tag open [WEBTRENDS-Tracking] HTML comment tag close

img alt="DCSIMG" id="DCSIMG" width="1" height="1" src="http://statse.webtrendslive.com/dcskvlalu100004rfxyw......

Re:doubtful

[MadMidnightBomber]

That's why I read all my mail with 'less /var/spool/mail/...'

Strange idea

[geek]

Never really looked at it this way. I think it's become ingrained in us that IP's are a way of tracking instead of a way of communicating. Being able to track them is just a side issue. If we look at an IP as a means of communication then does that not make it private in some way? I don't know exactly how I feel about this but I'd certainly like to have more rights rather than less of them.

Re:Strange idea

[Amorymeltzer]

I always visualized it akin to your telephone number - yeah, it's your number, but anyone can look it up in the pages. You work a bit to get on the no-call list and taken out of the directory, and of course, you can change your number or hide it from caller ID.

Re:Strange idea

[tjohns]

But even if you hide it from Caller ID, telephone numbers still get transmitted via ANI.

Re:Strange idea

[Anonymous Coward]

> yeah, it's your number, but anyone can look it up in the pages
Which is why most domestic landlines are ex-directory and any attempt to create a mobile directory has failed.

Re:Strange idea

[Anonymous Coward]

I'm looking forward to portable IPs.

"Hey at&t, I'm moving my service to speakeasy, and I'm taking 76.249.66.84 with me."

Re:Strange idea

[h2_plus_O]

Either way you look at this issue, in the end What we have here is a political authority decreeing something, which only goes as far as they can enforce it. After all, Spam and phishing and all manner of such activity is illegal where I live, but that doesn't stop torrents of the stuff from ending up in all our inboxes. So the EU folks now define your IP addy as 'personal'- the impact of this will fall solely upon entities that care.

I'm also always leery of legislating on technology- it has the funny effect of causing wierd workarounds that follow the letter of the law, but violate the spirit- you end up not getting ineffective legislation AND you end up with extra regulation, the worst of both worlds. For example, have a look at this, which is not an 'assault rifle' under california law, by virtue of the fact that the stock is an extension of the grip, which means the grip isn't a "pistol grip". It's functionally identical, it exists only because someone wanted to work around the rules as written- essentially the effect of this law was to make it worthwhile for people to devote energy to working around it.

So...

[deepershade]

Does that mean that if passed, then the RIAA can't use my personal data 'IP' to sue me? TFA was a little short on details of the reprecushions of this.

Re:So...

[barry_the_bogan]

Well TFS said it was in the European Parliament, since the RIAA is an organisation in the USA, I would assume it has little relevance to what the RIAA can do. However, the European equivalent of the RIAA might have more trouble pinning stuff on you.

Re:So...

[alx5000]

There's no European equivalent to RIAA... maybe there's such an organization on a country level, but I can assure you that sharing is completely legal in Spain, since fair use covers any kind of private copy, no matter whether you own the original or not (and yes, P2P falls into that category).

Re:So...

[smittyoneeach]

Seeing as how the VP is such a VIP, shouldn't we keep the PC on the QT? 'Cause if it leaks to the VC he could end up MIA, and then we'd all be put out in KP

Re:So...

[mr_matticus]

No. They'll still use your IP to sue you, just like they'd use your license plate to find you if you ran someone over with your car, or the registered customer of your cell phone if you made threatening calls.

This has potential implications for how easy it will be for them to get your IP and may legitimize some obfuscation methods.

Just like Target doesn't keep a list of all the phone numbers of customers that come in or out, websites you visit will now have to use a higher standard of care with your IP. They'll have to treat it like the other personal information they use--your name, address, phone number, and now your machine address.

What the before-the-chair-agains are, I don't know, though (you're looking for repercussions).

Re:So...

[rdoger6424]

I keep my PC on the GTK, you insensitive KDE-using clod!

Re:So...

[zoney_ie]

It's interesting how the various anti-piracy groups complete ignore national laws. Copyright warnings on films here in Ireland for example still state how public performance is illegal, including schools, etc. Except that under Irish copyright law, schools have an exemption (which remains even in the latest version of the law that is designed to implement EU directives on copyright). It is entirely legal to screen an ordinary film in a school here in Ireland.

Re:So...

[alx5000]

Yeah, interesting, in a sick, twisted interpretation of that word ;)

Here we have to go through all those "you won't steal a car" ads before getting to see a film in a theatre, when renting, or even before the copies we buy. And, lo!, no film I've ever downloaded from the internet had ever such warning. It's like they're trying to "educate" the wrong crowd. (Maybe they think that, if you're paying, you're a customer, and so you're still willing to play by their rules, whatever they may be, whereas if you're a 'pirate' you're a lost case... or stuff, maybe supposing they even think about the hand that feeds them is a little far-fetched...).

Reminds me of all those C&D that are sent out by companies, with no legal base whatsoever, trying to scare you into complying.

(Sorry about my English, I just woke up ;) )

Re:So...

[SharpFang]

In Poland, there's such an organization, ZAIKS. They request the IP-physical address mappings from the ISPs before sending the police to raid the people. ISPs are in no way obligated to give them the info, or withhold it - but since ZAIKS coperates with the Police, ISPs usually yield, just not to anger the Police - they can't really hurt them, but they can make their life more difficult, so the ISPs usually hand over the info.

Now with this decision in effect, ZAIKS would still sue you for copyright violation, just the same. But now you can sue your ISP for illegally distributing your personal data (it IS protected here!) and ISPs confronted with alternative between "inconveniences from the Police" and a serious threat of a valid legal action from the customer, are much more likely to make the right decision: "Sorry, this is personal data, we're not authorised to share it."

And they plan to implement this how?!

[CaptainPatent]

The only way to check and see if your IP is being kept is by changing the protocol entirely or by checking the company's servers. I'm guessing that not too many companies would appreciate people routinely rooting around, and if something to check if an IP is stored were to be implemented, the protocol would have to be vastly overhauled and it could slow down the internet 80% or more because of the extra time needed to "check."

The bottom line is this is much like the ruling in the US that companies had to keep a record of working memory (which is entirely impossible,) This seems to be more legislators talking about something they know very little about.

Don't get me wrong, I do appreciate the fact that it would make it harder for the ad industry to hunt you down which is always appreciated, I just don't think any reasonable implementation will work.

Re:And they plan to implement this how?!

[lordofwhee]

Easy way to tell if an IP is being used: ping them, or send a TCP SYN packet.

Re:And they plan to implement this how?!

[alx5000]

And, yes, while we're at it, let's not prosecute fiscal fraud (since it's so hard to check the company's books, and not too many companies want theirs scrutinized).

The same can be applied to websites collecting info on users to sell it to spammers. It's really, really (really!) hard to prove they've sold it, but that wouldn't stop legislators from sanctioning that law, would it?

If the EU passes a law that adds IP addresses to the list of protected private data, that only means it is illegal to collect them and store them. And if you get caught, face the consequencies, just like with any other law.

Re:And they plan to implement this how?!

[dleigh]

TFA (and some slashdot readers) seem to be assuming that he is calling for a ban on logging IPs. TFA is pretty thin on what was actually said at the meeting, just taking the assumption and asking a few search company spokespeople for their opinion on that assumption. The comissioner doesn't seem to be claiming anywhere that IP addresses should not be stored, or that regulators should check to see if they are not stored, or that any "implementation" of anything is or should be required. The only statement from him seems to boil down to "something which identifies a person should be considered personal data".

Re:And they plan to implement this how?!

[Anonymous Coward]

Except for the glaring difference that companies are required to report their books for tax purposes which is what leads to them being caught.
I agree that when found, companies keeping IP information should be prosecuted, but finding them (and even finding evidence if they're smart about it) is going to be much harder than you suggest if not impossible. The GP post is correct though that in order to even detect if the IP was being stored the entire internet protocol system would need to be highly revamped.

Re:And they plan to implement this how?!

[mxs]

You misunderstand the issue. If IP addresses are considered personal data, they can still be used during the connection and for tasks immediately related to servicing that connection -- akin to buying something with your credit card (which does not allow the store to store your personal information for purposes other than payment processing).

In Germany's current privacy and data protection laws, everybody has the right to decide what happens to their own personal information if it is being processed by computers. For instance, you can tell Amazon to delete all personally identifiable data they have about you, and they have to comply -- and you can ask any company that has personal data about you (such as your phone number, your address, etc. in telemarketing and plain old snailmail spam) to tell you where they got it from, what basis they have for keeping it, and to delete it from their databases. If they do not comply, you have a strong legal standing to compel them to give out this information (Mr. Sharr, who is quoted here, is the national representative for data protection, though there are more local ones as well -- if they suspect foul play, they /can/ raid businesses, and do so if warranted.

The legislators know very well what they are talking about. The scope of "personal data" is narrowly confined (anything that can be used to identify you or is saved in relation to data that can personally identify you or anything that could automatically be tied to you by a third party; IP addresses fall into the latter category; while a webhost will not be able to do the IP -> Name&Address resolution, the user's ISP could -- therefore the IP address is personally identifiable to a specific party through a third party and thus personal data protected under stringent data protection laws. This has been tested in court (the German DoJ, for instance, is no longer allowed to log IP addresses on their web servers by court order).

These laws don't "just" exist to combat the ad industry, but rather are an extension of one of our constitutions human rights, that is, the right to free self expression; this includes, under German law, the right to decide what happens to your data. There are, of course, certain restrictions (for instance, the DMV can process this data, as can other governmental bodies -- IF SPECIFICALLY AFFORDED THAT RIGHT BY LAW -- for their (narrow) purposes. You can waive this right (i.e. you can give your address to Reader's Digest for them to spam you with as they see fit -- if you give the permission (which is always revocable), they can do with your data whatever you allowed them to; Sweepstakes, for instance, are often designed to gather this data and get permission).

As for implementation thereof : I don't see a problem. The ip address can still be used to commmunicate same as before; it just can't be logged indefinitely nor used for purposes other than the intended one (i.e. connection establishment, communication, teardown vs. ad tracking) UNLESS the person in question has given permission. What this boils down to in Apache is adding mod_removeip. If no other information personally identifies your visitors (even through a third party), you can now log this data and do with it as you wish. Another possibility would be pseudonymizing the IP addresses with one-way hashes (though some care will have to be taken that this is not reversible easily, which may become a problem since there are only 32 bits in an IP address and thus bruteforcing is a viable tactic).

Nothing needs to be implemented to "check" whether the IP is stored. If you have a reasonable assumption that your contract partner is screwing you over, you can lodge a complaint with the Landesdatenschutzbeauftragter or Bundesdatenschutzbeauftragter (Mr. Scharr in this case), who will investigate -- same as when you suspect they are selling your address information illegally or engage in other illegal activites.

I for one am glad that there are some privacy advocates who thing about this s

Re:And they plan to implement this how?!

[unlametheweak]

The real issue would be how any privacy protections like storing IPs would be enforced. It is doubtful that a company would willfully admit to storing IPs if it is against the law to do so. I know if I were running a server (Web, FTP, IRC, etc), then I would store IPs despite the law, just because it makes sense from a security perspective (I would want to know who is online, who to ban, etc).

IP's contain less value over time (most consumers have dynamic IP's, can switch ISPs, use proxies, etc), so storing them for years wouldn't make a lot of practical sense anyways in most cases. Calling something as ephemeral and virtual as an IP personal property may be fine for politicians, but the utility of this is yet to be seen.

The more practical solution would be to legislate what a company or individual actually does with an IP. Do they sell it to spammers or crackers? or do they store it so that they can ban known spammers or crackers from entering their servers?

Re:And they plan to implement this how?!

[thannine]

The comissioner doesn't seem to be claiming anywhere that IP addresses should not be stored, or that regulators should check to see if they are not stored, or that any "implementation" of anything is or should be required. The only statement from him seems to boil down to "something which identifies a person should be considered personal data". And this would be the logical thing to say. Many posters have been wondering "how are they going to implement this?". Well, the thing is that laws like that are already in place (at least in Finland, but I'm assuming the rest of EU also), it's just the question of whether they apply to IP addresses as well as phone numbers, addresses, social security numbers etc. It's not illegal as such to store those, it's just regulated.

Re:And they plan to implement this how?!

[Anonymous Coward]

So, in your plan, how do websites fulfill their legal obligation to keep records on what they charge advertisers? Without some form of [at least somewhat] verifiable logs, there is no record proving that real users were ever shown the ads. In the US at least, that won't fly anymore in the post-Enron world of SOx. As a result, with your model the modern advertising-supported web would disappear.

Luckily, the EU has mostly been talking about an 18 month limit for storing personally identifiable information, which does allow businesses to balance their obligations. Of course, anything less would be complete hypocracy considering the EU's mandatory data retention policy for ISPs. Maybe that's what you meant when you said "The legislators know very well what they are talking about." They sure do.

Re:And they plan to implement this how?!

[pipatron]

Without some form of [at least somewhat] verifiable logs, there is no record proving that real users were ever shown the ads.

Great! This would mean that there's no ads on television, because such a model could never work. I guess I stopped watching TV because I'm crazy and see things that doesn't exist then.

Re:And they plan to implement this how?!

[Fastolfe]

Web ads are not billed based on placement, with the "hope" that some number of eyeballs will see it. Web ads are billed based on the number of impressions or clicks. SOX is a HUGE deal for these types of arrangements. If you're suggesting that web ads move to the TV ads model, that's a fairly significant change and I'm not really sure that would work out very well. You'd need some sort of awkward payment schedule for the millions of tiny sites out there that generate just enough traffic for a few bucks a month in revenues. These add up to a lot for advertisers but would be incredibly difficult to bill.

Re:And they plan to implement this how?!

[jez9999]

Don't get me wrong, I do appreciate the fact that it would make it harder for the ad industry to hunt you down which is always appreciated,

That's an idiotic opinion. If you find a way to block ads, then it doesn't matter either way; if not, at least personalized ads will be personalized. Your fear of them 'tracking you down' is irrational, as if you think they're kidnappers or something.

Re:And they plan to implement this how?!

[srck]

Just to echo this comment, this is a very good thing.

The legal definitions of "personal data" in the EU are quite clear - it's not the articles of data itself that counts, it's the usefulness is *identifying* a living individual from that data that makes the difference. For example, a name is a public identifier (and known to most people who browse a reasonable corporate intranet, let's say), and a residential or business address is clearly public information. You wear a name badge at a trade show or conference, big deal - and most people in a given area will know that 24 Acacia Avenue exists (from walking past it to the bus stop), in isolation these items are not noteworthy. It's when you can put the two together that an individual is identifiable (in the scope of directive 95/46/EC), and that personal data begins to need protection.

IP numbers in and of themselves are predictable (based on finite multiples of 4 numbers up to 255) and obvious, but when you put a name to an IP number, the state should provide some basic protection from the free dissemination of that couplet of information. Even more so when one includes - from the ISP, say - the subscriber's residential address, or employer's name and address.

That the EU is now extending this protection to IP addresses *in the context of identifying people and their actions* is a step forward - let's just wait for the UK government to accidentally cock it up --- http://www.out-law.com/page-4717, or just lose it --- http://www.out-law.com/page-8649.

Re:And they plan to implement this how?!

[Snaller]

"The bottom line is this is much like the ruling in the US that companies had to keep a record of working memory (which is entirely impossible,) "

Not only would that be possible (but expensive) but that wasn't what the ruling said.

"This seems to be more legislators talking about something they know very little about."

On the contrary, for once someone who does know what he is talking about.

Re:And they plan to implement this how?!

[Anonymous Coward]

The reference was to a different US case which recently appeared on /. where legislators wanted companies to keep entire records of working memory. Link anyone?

I'm pretty sure he's correct about keeping working memory being impossible, because whenever you would copy working memory to disk, it would change values within the working memory. This is not to mention the latency problems.

A couple of good points have come up to about security too. I copy down the IP address of people trying to intrude into and beyond my home router, why should companies not be allowed to make this same security measure?

Re:And they plan to implement this how?!

[Midnight Thunder]

The only way to check and see if your IP is being kept is by changing the protocol entirely or by checking the company's servers. I'm guessing that not too many companies would appreciate people routinely rooting around, and if something to check if an IP is stored were to be implemented, the protocol would have to be vastly overhauled and it could slow down the internet 80% or more because of the extra time needed to "check."

I doubt they will systematically check companies, but rather when something does turn up they have the law to use. From what I understand using an IP is fine, but associating with a specific user is not. A number of sites, such as Wikipedia use an IP address in lieu of a username, but when the user is logged in the username is used instead. I am sure this would still be tollerated, since the IP address is not explicitly tied to any one user.

Re:And they plan to implement this how?!

[amck]

They are not contradictory (The EU directive is European law, SOx is USanian ...)

The directive on mandatory data retention requires the data to be kept for law enforcement purposes.
After the 18 month (typical; it varies from country to country) deadline, it would typically be deleted,
as there is a liability to the holder in the event of the data becoming public; In Germany, for example,
the data can only be kept as long as it is required for billing purposes (billing the ISP's user).

You can argue that good practice would be to delete ASAP anyway: if you hold the data longer than necessary,
and the data is leaked / stolen in a web breakin, etc. the company would be liable for contributory
negligence in holding the data and making it available for theft.

But the main point: there is no law in Europe to require a web company to disclose the IP addresses to advertisers
to prove anything. How they prove they have real traffic is up to them: e.g. logging a hash of (IP address, client browser, etc.)

Just Addresses

[excelblue]

I am truly disappointed in this. If IP addresses are a means of communications, wouldn't that be similar to phone numbers?

It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here.

Re:Just Addresses

[davetpa]

It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here. But what about if the phone company sells your phone number (no other information attached) along with a record of all the numbers you called and all the numbers that called you? Now your phone number is no longer just a means of communication.

The scary part is that they've been doing that for years WITH your other personal information!

Re:Just Addresses

[Harmonious Botch]

Or is my street address personal data? Or how about "the girl next door"? That is a unique identifier too.

Re:Just Addresses

[mr_matticus]

Yeah.

That's exactly what's going on. Your phone number is personal data, too.

I don't understand the source of your disappointment, unless you think that personal data is private information. It's not.

Re:Just Addresses

[__aaakhl8499]

1. this is old news. WU has classified IP as PII for a long time now.

2. Yes - it is exactly like your phone number. Given your phone number, I stand a very good chance of figuring out who you are - thus it is personally identifying.

The reason that this is a bad thing to store is that I can get a court order to request all the search records from Yahoo that were made from your IP address - thus showing that you did indeed search for 'male escorts NYC'.

Having it noted as PII means that nobody can store it (in search logs for example) without your express permission, and thus if it ain't logged, the search query can't be associated with your good name.

Re:Just Addresses

[dnahelix1]

Yes, but I can block my phone number from showing up on your caller id, though.

Re:Just Addresses

[Beriaru]

Your name is personal data, but not private.
Your phone number is personal data, but not private.
Your Address is personal data, but not private.
And of course, your IP is not private... but is part of your personal data.

Maybe in USA there is no difference between private and personal data, but in EU there's a big difference: nobody can NOT store your personal data without warning you and giving methods to correct AND ERASE your data.

Re:Just Addresses

[QuantumG]

nobody can NOT store your personal data without warning you Well shit, I better warn you right now that I'm not storing your personal data.. that goes for everyone else reading this: I AM NOT STORING YOUR PERSONAL DATA!

Whew, lucky I got that out of the way.

Re:Just Addresses

[neoform]

I'd say it's more like a home address. Would you get in trouble for writing down someone's address? Why should an IP address be any more 'personal'? I'd say both are quite impersonal.

Re:Just Addresses

[Tavor]

Indeed. Should us Americans use a similar setup, I believe the RIAA would not be able to do it's I.P. address drift-net tactics. Though, as always, IANAL. Though I would love to hear NYCL's take on it.

Re:Just Addresses

[SnowZero]

But what about if the phone company sells your phone number (no other information attached) along with a record of all the numbers you called and all the numbers that called you? Now your phone number is no longer just a means of communication. I would say that we need laws that differentiate between storing and selling?

I don't care if Joe the barber keeps a record of all the appointments I've ever made with him, and the phone number I used to make each appointment. What I do care about is that he does not give away or sell this information, and that he uses due diligence to protect the information from being stolen.

Anything else is getting far too close to a world like 1984, where keeping a diary can become illegal.

Re:Just Addresses

[Anonymous Coward]

[...] but in EU there's a big difference: nobody can NOT store your personal data without warning you and giving methods to correct AND ERASE your data.

I suppose you wanted to say: "nobody is allowed to store your personal data without warning you and giving methods to correct and erase your data."
This is a principle of German "Recht auf Informationelle Selbstbestimmung".

Anyway, I agree with Germany's 'commissioner for data protection and freedom of information' Peter Schaar (wrong name in TFA) that an IP is public, but nevertheless personal data (better term in German: "personenbezogene Daten") because as the 'Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data' (see Directive 95/46/EC) states:

Article 2
Definitions

For the purposes of this Directive:
(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

Some prior commentators already agreed that a telephone number is personal data (though many don't seem to know the difference between private and personal data). Why not treat IPs the same way?

Please note that not all is well in Europe since telephone numbers (already regarded as personal data) and IPs have to be stored by the associated carriers (ISPs for example) for later processing by law enforcement agencies (allegedly solely) in the course of investigating terroristic activities and other crimes (see 'Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks').
This is heavily disputed (see e.g. http://www.dataretentionisnosolution.com/ and Digital Rights Ireland challenge to Data Retention).
By the way, there are some proposed methods to disable logging of IPs regarding Apache webserver - et al..

For more information about 'EU Data Retention' see EU Data Retention - doqumentation and Electronic Privacy Information Center.

Re:Just Addresses

[Zironic]

You're not allowed to store my address either without my permission.

Re:Just Addresses

[Snaller]

"It shouldn't be any more personal than a phone number is. Whenever someone calls me, I like to log them on my caller ID. I don't see a difference here."

My phone number IS personal, its none of your business unless i give it to you. Its not listed and called ID is disabled.

Re:Just Addresses

[xaxa]

In the EU any company storing personal data has to register with someone (the Information Commissioner's Office in the UK) and say what data they store and what it's used for. They can only use it for what they say they use it for.

Re:Just Addresses

[mvdwege]

The use you hypothetical Joe the barber would put your telephone number to is exactly within the scope of the EU privacy directive upon which German law is based. Joe must tell you what info he stores, and what use he puts it to. If that use is vital to his business relationship with you, it is allowed. All other uses need your specific consent.

So Joe can store your appointment information. Without your consent, he may have to remove all telephone numbers except on the latest appointment. He can most definitely not sell your information to a third party. Not without explicit consent in any case. But he may keep and process that information if it is vital to manage your appointments with him, and he does not need consent for that.

Mart

Re:Just Addresses

[Anonymous Coward]

nobody can NOT store your personal data without warning you Oh come on, give the guy a break, maybe he just forgot another negative, you know, like, nobody can NOT store your personal data without not warning you
... Or maybe the OP is just Russian ;)

Re:Just Addresses

[QuantumG]

In Australia a company or government agency or individual has to state why they are collecting data and what they will use it for, and they are legally prohibited from using it for any other purpose.. oh, and you can demand to see what data they have stored about you and how they are using it and have it erased if you desire. These are called "privacy" laws. So, sounds about the same as Europe.. USA, behind again.

Re:Just Addresses

[xaxa]

Quoting a lawyer, in England: "The biggest threat to Europeans' privacy is American corporations."
I expect you can s/European/Australian/ in that.

Re:Just Addresses

[SnowZero]

German law on this matter sounds like a pretty good compromise. If we applied this in the US though, the business would need sufficient records to pass a tax audit, which for an appointment-based service would generally include enough information to recontact customers (so one can prove that they indeed exist). A tax audit can go back up to 7 years, thus a small single-proprietor business would have to keep records that long (It may be different for large companies, I'm not sure). That puts a big dent in privacy when compared to ideal EU model. I assume the tax law is quite different in Germany, but does it handle a similar problem?

Re:Just Addresses

[mvdwege]

I have no clue how German tax law works. I just brought up Germany's privacy laws as the EU commissioner in question was German, so I assume he wants to model IP privacy on his countries implementation of the relevant EU directive.

I do know that Dutch tax law isn't as broken as your U.S. example.

Mart

Re:Just Addresses

[gr8scot]

Have they ruled yet on whether DNA is 'personal data'?

Whoa

[MattPat]

I can't believe what I'm seeing. Is this actually a semi-responsible technology-related decision made by a legislative body?

I'm not saying I necessarily agree with the complete "scrubbing" of Google et al.'s records, as it were, but the classification of an IP address as personally-identifiable information is definitely a positive step towards Internet freedom, and a reasonable expectation of some degree of privacy. At the very least, it gives you a leg to stand on when you find out that some company has been selling your browsing habits to an advertiser.

Re:Whoa

[gotzero]

It is hard to comprehend... Keep in mind it is the EU, not the US. ;) I sure enjoy checking out the server logs to my site, if only to see that we do reach worldwide, even to bots... I can clearly identify with both sides of this issue. Honestly, you have no privacy online if you do not take certain steps, and the general public should not be shocked by this!

Well,

[Anonymous Coward]

"...while Microsoft does not record IP addresses for anonymous search."

Well, they will now.

Good news for cookies.

[gandhi_2]

AFAIK, server-side IP-logging one of the few ways to maintain stateful web sessions without cookies.

This idea would kind of guarantee that cookies have no competition.

Sucks if you are an ISP. You buy a block of IP's but you can't use them...they are someone elses personal info? /. assigned me a user ID number....I believe that number properly belongs to slashdot. gandhi_2 though...I stole that from Wierd Al.

Trust Microsoft

[Doc Ruby]

According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search.

Unless Microsoft is just lying. How can they be trusted, with their track record?

Re:Trust Microsoft

[Anonymous Coward]

Unless Microsoft is just lying. How can they be trusted, with their track record?

Here, smoke this... it will help.

Re:Trust Microsoft

[the bluebrain]

>> >> According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search.

>> Unless Microsoft is just lying. How can they be trusted, with their track record?

Basically: "Never attribute to malice what can be adequately explained by stupidity". ... you know ... unless it's Microsoft ;)

Re:Trust Microsoft

[Anonymous Coward]

Unless Microsoft is just lying.

That's like saying "Unless the ocean is wet".

Re:Trust Microsoft

[Doc Ruby]

Moderation +2
    50% Interesting
    30% Insightful
    20% Flamebait

At least 20% of modders trust Microsoft more than their own lying eyes.

Ok, more craziness

[Psychotria]

How is an IP address more "personal" than my GPS location at any given point in time? Sure an IP address can be "mine" if I have my own domain etc. This is not usually the case though. Most IP addresses are "owned" by the ISP and assigned to people via DHCP (except for static ones). This is not too much unlike a restaurant reserving tables for a customer, and sometimes reserving a table for a customer for a long time. It doesn't make the table being reserved the customers the customers personal property; the restaurant still owns it--it is no more personal than, well, any other table in an anonymous bar (for example). I can't see how IP addresses can be "personal".

Re:Ok, more craziness

[Anonymous Coward]

Your GPS location is also subject to privacy laws in Europe, if it's personally identifiable, i.e. it can be attributed to you. Either would allow someone to track your whereabouts (virtual or real.) What's relevant isn't that you own the address or location. It is the fact that it is information about you which makes it private data.

Re:Ok, more craziness

[Anonymous Coward]

I have a static IP address. Everybody ought to have a static IP address -- a bunch of them to be exact. The distinction of "server machines" and "client machines" is unnatural. It was the result of the IPv4 address shortage and has provided companies a nice way to keep the consumers under their thumbs (Skype).

The European privacy rules don't apply to secret information only (as though you social security number, DOB or mother's maiden name were secret). The rules regulate how you are allowed to compile and index databases on people. You are not allowed to use the SSN as a customer ID because that would make it too easy to join databases. Similar restrictions should apply to other globally unique IDs.

Re:Ok, more craziness

[Anonymous Coward]

IP addresses are personally identifying traits. To use your analogy, it's like "the guy that always sits at in the booth in the corner." All you have to do is ask the server (no pun intended), and she'll tell you the guy's name, favorite entree, and how well he tips.

However IMHO, the elsethread discussion of requiring notifications for storing and allowing you to request the deletion of your personal data shouldn't apply to IP addresses because it's part of the communication protocol, and because effective access control requires extensive logging. You can't tell someone not to keep the envelopes of the letters you mailed them; you shouldn't be able to demand that they remove your IP address from the logs/databases either.

If people don't want someone to know their IP address, they can use a proxy. But they also shouldn't complain when the proxy gets banned for abuse because other users are doing not-so-nice things on the site they're trying to access.

Re:Ok, more craziness

[mxs]

How about IP address + timestamp ?

Your address ISP Webhost IP + Timestamp GET /hot/brunette/doing/funky/stuff/naked/001.jpg --> Your address --> GET /hot/brunette/doing/funky/stuff/naked/001.jpg (and that is personal data since it identifies you as a person doing something.

Re:Ok, more craziness

[Psychotria]

Yeah; your IP address still isn't private though, so I stand by my original argument. There are ways to get around that of course.

Re:Ok, more craziness

[mxs]

Your original argument was "personal data" not "private data". There is a difference. It's not about hiding your personal data, it's your right to decide what happens to your personal data -- in particular whether it can be used for stuff other than the purpose you intended, legally.

Re:BUTTSECKS?

[Anonymous Coward]

Yep. Just wouldn't be a news cycle without some death porn.
Kind of a shortage of nubile women dying macabre deaths at the moment, but the posthumous role as The Joker puts an off-beat spin on things.
So much schadenfreude, so little time.

Your Computer Is Broadcasting an IP Address!

[Anonymous Coward]

Unfortunately (because he's a smart person with the right ideas) the guy has no power beyond telling everyone what he thinks data privacy should be and how sorry the actual state of affairs is. This may eventually lead to more stringent regulations, but note that in Germany, it is already a violation of privacy laws to record personal information, including IP addresses, in logfiles without telling the visitor about it. Apparently the justice department hasn't heard of the law, because their web server does precisely that. And so does everybody else's server and nobody cares.

Re:If it's personal property...

[Anonymous Coward]

You know, the keen insight and argumentation on display in this audio clip of a Paulestinian really tempts me.
To vote for him, or disembowel myself with an ice pick, I'm unsure which...

Silly?

[Damocles the Elder]

I realize it sounds silly at first glance, but I'd agree with the general idea. While an IP isn't private per se, you don't run around IRC and chat channels shouting your IP at random people. Your IP is between you and whatever sites you choose to visit. In addition to that, you generally don't want your named linked to an IP. Even if an untrustworthy website, they have your IP but not your name with it. Once you have a name and an IP, someone with an axe to grind can start trying in earnest to break the door down, or DDoSing your personal website, if you have one.

Begs the question...

[__aaclcg7560]

If IP addresses are personal data, who owns 127.0.0.1?

Re:Begs the question...

[scoot80]

Your computer does.

Re:Begs the question...

[lexarius]

Well, that's my computer's IP address, so it's obviously mine, and I'll have to ask you to stop waving it around like that.

Re:Begs the question...

[jroysdon]

Same guy that owns ::1

Re:Begs the question...

[Anonymous Coward]

Obviously since 127.0.0.1/8 is in my routing prefixes, *I* own that IP block. Get off my damned lawn.

Re:Begs the question...

[Anonymous Coward]

Ha, you revealed your identity. Your getting nuked now Mr. 127.0.0.1!

Re:Begs the question...

[Swampash]

More to the point, who owns 192.168.1.1????

I had it first!

IP

[Eddi3]

Based on this conclusion, an IP == IP (Intellectual Property), then?

So...

[Anonymous Coward]

Those annoying ads, about "Your computer is broadcasting your IP address"... were right all the time?

Major legal issues arising?

[DigitAl56K]

If IP addresses are personal data, and you visit my web page, and my access logs show I served an IP that you used at a certain time (or even just that I served an IP you used), am I now subject to laws regarding the holding of personal information? If you were to contact me and request that information how would I authenticate you? If I was to disclose certain parts of the "personal data" that you claimed belonged to you, how could I know that I was not disclosing someone else's personal information, given that I can't necessarily authenticate you or anyone else and IP's can be re-allocated? If I ban an IP address for abusing my server and it is later re-allocated to someone else, is that slander? If I forward an e-mail whose headers contain IP addresses of relay servers, is that unlawful disclosure of personal information?

This is totally ridiculous.

Re:Major legal issues arising?

[arkhan_jg]

You're assuming the restrictions on personal data are greater than they are. If IP's are judged personal data, that makes them like a telephone number or an address (The Act covers any data which can be used to identify a living person). Still, you do have some responsibilities, *if you're in the EU* with regards handling personal data. Basically, there are restrictions on publishing it or sharing it around without permission, and you can only use it for the original purpose for which it was collected. (Sensitive personal data, i.e. really private stuff, is more strictly controlled)

For example, say you were to publish your webserver access logs; you'd be better off anonymising the IP's somewhat first. Just as if I call you on the phone, you're allowed to store the caller ID, call me back or even put me on your internal call-list - but publishing my phone number, along with transcripts of our conversations without permission would be a no-no. Nor can you flog it off on the open market to cold callers. When you sign up for a phone line here, you're asked if you want the number to appear in the phone book, or go ex-directory.

Again, this only applies if you live in an EU country with data protection laws.

If IP addresses are personal data, and you visit my web page, and my access logs show I served an IP that you used at a certain time (or even just that I served an IP you used), am I now subject to laws regarding the holding of personal information?
If you're an individual holding the data for your own personal use, you are exempt from much of the data protection act, including having to tell people when they ask what data you hold on them. If you're a company, when given a proper request and the fee to handle the request, would have to look in the logs when given the IP, and would have to report that yes, you hold 7 instances of that IP in your log. If your log expires before you have to answer the request (40 days I think) , you don't have to give anything.

If you were to contact me and request that information how would I authenticate you? If I was to disclose certain parts of the "personal data" that you claimed belonged to you,how could I know that I was not disclosing someone else's personal information, given that I can't necessarily authenticate you or anyone else and IP's can be re-allocated?
You don't have to disclose the other data that goes with the IP, just the IP itself that they supply to you. You then say whether you hold that or not.

If I ban an IP address for abusing my server and it is later re-allocated to someone else, is that slander?
It'd be libel as it's written, not slander as that's spoken. Libel only applies if you *publish* lies about someone, such as 'this IP searches for goat porn' (when they don't). Storing it for your own blacklist is fine. If you're a company, the new holder of the IP could ask that you correct your record under data protection law though.

If I forward an e-mail whose headers contain IP addresses of relay servers, is that unlawful disclosure of personal information?
No, because relay servers do not identify a living human. Also, it's the processing and storage of personal identifying data for later use that's covered, not mere transmission. The owners of servers that store those emails would likely have responsibilities under the data protection act, but then they do anyway because of the contents of the email itself!

Re:Major legal issues arising?

[GryMor]

How does this work exactly? Due to dynamic ips, NAP, non routable addresses and other network idiosyncrasies, an ip doesn't identify a specific person without further context any more than the name John Smith identifies a specific person without further context. Can I really make a request of a company to identify how they got every occurrence of John Smith in their database? As this provides context, how does it fail to infringe on the privacy of the other John Smiths? Similarly, if an well formed inquiry is made about a particular ip, how can I respond without potentially violating the privacy of the other, ephemeral, users of that ip address?

Return Address is private then Dynamic Nature

[FromTheAir]

I suppose that the return address on an envelope is private now then. An IP address is the communications address. It does not mormally reflect the same use because they are often dynamic rather than static. Hundreds of people can come through the same IP address. So an IP address seldom represents a single entity for more than a short period of time.

On the other hand I think who the IP address is assigned to below the provider is private information. In other words ISPs whould not be divulgin who they assigned an IP address to becuase this could allow individual specific information to be collected.

IP addresses are used for HTTP

[Not Invented Here]

But what about all the other ways that IP addresses are used and stored?

• Will I need to register under the Data Protection Act in the UK because a default Debian install logs the IP address of failed ssh attempts?
• Will this shut down Spamhaus and other DNS block lists?
• Will IP based Geolocation services have to shut down?

Re:IP addresses are used for HTTP

[Zironic]

They're fine as long as they don't give away the IP to anyone else.

Re:IP addresses are used for HTTP

[srck]

http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_5#pt4-l1g36

says that "domestic purposes" are exempted from the Data Protection Act, so no, I'd not bother the ICO right now, I hear he's a bit busy.

Doesn't quite work as an analogy

[CaptainZapp]

yeah, it's your number, but anyone can look it up in the pages

While everybody can check a directory such directories don't exist for IP numbers. Respectively the information needs to be obtained from the ISP.

I never heard of the requirement of a court order before checking a phone directory.

Re:Doesn't quite work as an analogy

[Anonymous Coward]

Being in the phonebook is, and should be, optional.

IP addresses are personal data...

[nguy]

... and that's why the German government collects them, just like all other personal data.

Germany's positions on issues of privacy are rather two-faced, having one of the most intrusive surveillance states in the world, while at the same time proclaiming itself to defend personal freedoms.

worry about the German government first

[nguy]

In Germany's current privacy and data protection laws, everybody has the right to decide what happens to their own personal information if it is being processed by computers.

Well, that is, except for all the ways in which the German government uses that information to track you and spy on you. German privacy attitudes are schizophrenic: they live in a country with a history of governments perpetrating genocidal mass murder based, in large part, on personal information and connections between citizens. You were a Jew? You died. You had contact with communists? You died. The East Germans even continued that proud tradition of neighbors spying on neighbors and kids spying on parents throughout the 20th century.

Yet, all Germans seem concerned about is whether big, evil US corporations can get their data, while everything they do and say can be traced back to them: phones need to be registered, web sites need to provide full information, there is effectively no anonymous free speech, televisions need to be registered, the German government can get all your connection information, and you even register your religion with the German government.

German politicians talking about "privacy" is ridiculous. The "Bundesdatenschutzbeauftragter" is a smokescreen for one of the most intrusive surveillance societies in the world. Germans should worry about their own government before trying to tell other nations about data protection.

Re:worry about the German government first

[Yvanhoe]

Germans learned from nazism and sovietism that privacy was a damn serious issue. That any entity with personal information about several million people can turn into something nasty. They completely understand how IP logs could be used in a bad way, Americans tend to be optimistic about this but Germans already have undergone two periods of oppression that relied on an extensive invasion of privacy.

Re:worry about the German government first

[nguy]

Germans learned from nazism and sovietism that privacy was a damn serious issue. That any entity with personal information about several million people can turn into something nasty.

Well, apparently Germans didn't learn:

http://www.heise.de/newsticker/meldung/98747

http://www.tagesschau.de/inland/vorratsdatenspeicherung22.html

Americans tend to be optimistic about this

Optimistic? Americans are deeply distrustful of their government and protective of their ability to remain anonymous, far more than Germans.

but Germans already have undergone two periods of oppression that relied on an extensive invasion of privacy.

Yes, Germans did. The question is whether they learned anything from it, and looking at current German government policies, that seems questionable. Americans, in contrast, have been vigilant enough to avoid both fascism and communism for two centuries, and public debate about issues of privacy, government intrusion, and anonymity is far more vigorous in the US than in Germany.

Re:worry about the German government first

[mxs]

Sorry, but no. Even the German government is bound by its privacy laws -- in fact, they privacy laws are even tougher for governmental data processing since they are backed by the Grundgesetz, i.e. our constitution (which technically is law to protect the individual from governmental action). East Germany doesn't exist as a state or a government anymore. The third reich does not exist anymore (but thanks for Godwin'ing this conversation). Those days did NOT have data protection laws, let alone computers they could be applied to. The Stasi does not exist anymore -- you seem to have missed the unification of Germany in 1990, and the abolition of those communist practices.

You misrepresent the state of data protection in Germany in quite fundamental ways, but then again, misrepresentation seems to be your aim. Phones need to be registered -- sure, with your carrier. The one who bills you. Same as the US and other countries -- and no other registration is necessary. The governmental law enforcement agencies can compel a carrier to give up information on a specific phone line (same as everywhere else) with law-based subpoenaes.

Websites need to provide an Impressum, that is correct (well, technically there are some limitations to that -- not every webpage is legally bound to have an Impressum, but all the ones doing ecommerce or representing companies or business interests do. There is plenty of anonymous free speech, and there is no requirement for free speech to be non-anonymous. Televisions are registered with the GEZ (Gebühreneinzugszentrale) for taxation of that unit (we pay for some basic television programming. Whether this is good or not is debatable, but that is not subject of this discussion). The privacy laws affect this governmental agency as well though -- data obtained through the GEZ may not lawfully be shared with other government agencies for any purpose. If the GEZ writes you a letter, you have a right to obtain information on how they got your information, and you can compel them to delete it.
The German government cannot get all your connection information. I do not know where you get your facts from. Sure, law enforcement can subpoenae your records from your phone company (same as the US) with a judge's decision -- but they can't do that nilly willy, there needs to be (criminal) cause. As for registering my religion with the government : I can leave that field blank. It is used for taxation; while I abhor this practice, it's nevertheless not something that is problematic -- the US census asks the same question, and, as noted before, privacy laws even affect the taxation arm of the government. You have legal recourse should it be misused for anything other than taxation.

You spread FUD like a master, but back it up with nil. Germany has one of the toughest privacy laws around. You should be so lucky as to have these laws. The envy you display is palpable.

Germany is not perfect, far from it. It has its problems. Privacy laws as they stand now are not one of those problems (though Patriot-act like crap legislation proposals creeping in are).

Re:worry about the German government first

[nguy]

Phones need to be registered -- sure, with your carrier. The one who bills you. Same as the US and other countries

This is quite incorrect. In the US and other nations, you can get a phone for cash or with just a credit card number (and you can get anonymous credit cards if you like). In Germany, you need to give your home address to the carrier, because of government regulations. This is one of the reasons getting a Skype number in Germany is such a problem.

(In addition, in Germany, your home address itself has to be registered with the government.)

As for registering my religion with the government : I can leave that field blank. It is used for taxation; while I abhor this practice, it's nevertheless not something that is problematic

That, too, is incorrect. You might personally still consider yourself a Catholic or Protestant, but if you don't declare yourself officially to be a member of those churches, those churches won't consider you a member. Furthermore, you can't just "leave that field blank"; if you want to leave the church, you need to do so by paying a fee and registering that fact with the government. Once you do, a number of people will find out, including your employer. And, of course, that information is available to the police; who do you think they'll go looking for first when it comes to terrorism? Registered Christians or registered non-Christians?

The German government cannot get all your connection information. I do not know where you get your facts from.

German ISPs and carriers are now required to retain all connection information:

http://www.heise.de/newsticker/meldung/98747

http://www.tagesschau.de/inland/vorratsdatenspeicherung22.html

Germany has one of the toughest privacy laws around. You should be so lucky as to have these laws.

Germany does have tough privacy laws. The problem is that you can't rely on tough privacy laws to protect you from governmental abuse: once the government collects the data, if it's intent on misusing the data, the laws don't matter. If a new fascist government came to power in Germany, it would immediately have all the data it wanted, on religion, on social networks, etc.

You misrepresent the state of data protection in Germany in quite fundamental ways, but then again, misrepresentation seems to be your aim.

I'm not misrepresenting that at all: Germany's privacy laws are useless against governmental abuse because you need to trust your government to respect those laws in order for them to mean anything.

What your response illustrates is that Germans still have a naive trust in their government ("obrigkeitsglaeubigkeit"); that's what allowed the Nazis to come to power last century, and who knows what evils it will bring this century.

Re:worry about the German government first

[Anonymous Coward]

Germans learned from nazism and sovietism that privacy was a damn serious issue.

Fascism and Communism.

Re:worry about the German government first

[mxs]

You should specify cellphone when you are talking about phones. Though in that you are correct, you need to leave your home address with your carrier. NOT the government though. The carrier needs to have this information on file, but there is no obligation to turn this information over to any government agency absent a judge-ordered legal subpoeana.

No, I do not need to pay a fee to leave that field blank. It is also quite common NOT to have that field filled out, after all, having it filled out means that your paycheck will miss a couple bucks in "church taxes". I could care less whether the Catholic church or the Protestant church consider me members or not. And no, the police does not have access to this information absent a judge-ordered lawful subpoena for a specific person -- and even that is stretching it, unless you are being investigated for tax fraud.

You found the Vorratsdatenspeicherung stuff; these are EU regulations that are transformed into local law, and yes, it's an abomination. But again, this information is collected by the carriers, cannot be accessed nilly willy by any law enforcement agency (and thus requires a juddg-ordered lawful subpoena), and, by law, is very tightly committed to that one purpose, i.e. it may not lawfully be used for any other purpose than access to law enforcement for subpoenas issued exclusively for high crimes. The RIAA/MPAA is not going to be able to use that information.

You should also know that this law is relatively new (less than a month) and already being challenged before our supreme court (in its starting stages). Furthermore, while phone carriers are already bound to its provisions, ISPs are not until mid-2009.

You are quite correct that data-hungry government databases are a bad idea (even IF you considered the government to be benign, the security implications would be astounding). You also seem to not consider the fact that this data is NOT stored by the government, not accessible by the government, and the data protection and privacy laws have an entire part (of three parts) dedicated to specific protection laws to be used against governmental agencies (which are quite a bit tougher even than those usable against in private relationships such as with corporations).

A new fascist government would indeed have immediate access to religious affiliation (as taxed) and census information (though that's anonymized). A new fascist government could also institute new laws for all data to be sent to them, a new fascist government could kill all its citizens and declare war on Mars, a new fascist government could use the nuke in Berlin to wipe out some drugdealers, and a new fascist government is fiction. It's not real. When you CHANGE the government, any government, it can institute a new rule of law, new provisions, new acts to curb your civil rights (Patriot act is a prime example, though there are many others in many other regions of the world). We have to evaluate the state as it is now and as it would be allowed under current laws enacted, not as it could be in some undefined future where you nudge the parameters into a horror scenario. It makes for good science fiction, but not for a proper comparable and comparative analysis.

As for needing to trust your government to obey its laws : The privacy laws are not useless, and the examples you cited mostly do not give the government direct access to the troves of data to be abused at will. Of course there will be abuse of data the government has. If and once that happens, you have strong legal recourse -- specifically through the German Grundgesetz (akin to the US constitution in scope) protecting primarily against government power, and through specific laws (such as those privacy laws). The system is not perfect, no system can ever be, though there are effective checks and balances -- so long as the populace cares about it enough.

You seem to love to compare current Germany to Nazi Germany. You seem to forget one vital piece of historic fact though -- Germans, generally,

Re:worry about the German government first

[nguy]

You should specify cellphone when you are talking about phones.

The law applies to all phones: land line, Internet, and cell phones.

No, I do not need to pay a fee to leave that field blank.

You can't "leave" that field blank; that field is filled in automatically on your tax forms every year unless you take explicit action. In order to change it, you need to explicitly file a form with the government, and there's a fee associated with that. http://www.kirchenaustritt.de/

And no, the police does not have access to this information absent a judge-ordered lawful subpoena

Sources? And what's to stop them anyway?

If and once that happens, you have strong legal recourse

How can you sue over something that you don't know about?

You seem to love to compare current Germany to Nazi Germany.

Don't put words in my mouth. I'm not "comparing" current Germany to Nazi Germany. The analysis of "what would a fascist government do with this data" is one people also apply in the US in political debate. The fact that you dismiss the possibility and instead say "we have laws to protect us" shows again that you simply aren't vigilant.

You seem to forget one vital piece of historic fact though -- Germans, generally, know their history.

And where is that "fact" documented? Germans generally do no better in academic subjects than other nations (cf Pisa). And your own knowledge of German governmental powers seems to be somewhat limited.

but I posit your rambling about how we are heading for another Nazi Germany are quite narrow-minded paranoia -- a good Feindbild, if you will.

Germany isn't a "feind"; with tens of thousands of US troops stationed in Germany, Germany is hardly in a position of doing harm to anyone. But it is also hardly a shining example of a long democratic tradition or popular democratic values. Given its history, Germany has something to prove and should be at the forefront of free speech, separation of church and state, and protections against intrusive government, but it clearly is not; the German government and police have more powers than in many other democratic nations, church and state are more intertwined, and free speech is less protected than elsewhere.

Re:worry about the German government first

[mxs]

Well, for regular landlines it's quite natural that your CARRIER will know where to install your phoneline and where to send the bills -- anywhere in the world. The case you seem to be concerned about is prepaid cellphones requiring address information, though.

As for change of affiliation costing a fee, you seem to be correct for some states. I did not have to pay anything when I did it, since I'm in one of those states where it does not cost anything.

Sources would be the BDSG (Bundesdatenschutzgesetz). Personal data of a special nature (religious affiliation is of that kind, specifically mentioned) gets even more protection. The BDSG's structure is akin to a default-deny firewall, i.e. everything is forbidden unless explicitly allowed -- and the handling of such data is limited.
As for what's stopping them, you need to be a real cynic to ask that question, and can ask it in any locale, anywhere in the world. If you suspect foul play and can prove it, you have recourse.

As for not knowing about your rights having been violated, well, that is another one of those questions you can ask anywhere in the world. My assumption would be that if your data is (ab)used in an unlawful manner, there is probably a reason behind that. You will, sooner or later, learn that reason (be it due to a letter you get in the mail, a raid on your home, etc). A decent lawyer should then be able to trace back the unlawful action to the unlawful release or abuse of information and have recourse; certainly this is not optimal (since at that point the damage may already be done), though at least you do have recourse. This is quickly deteriorating into a discussion about the nature of right and wrong though, and how modern law enforcement, legistlation, politics, and society works or ought to work. Your original point in this discussion seems lost in the fray.

Well, your Nazi Germany references certainly seem pointed, since you bring it up as a matter of fact. I'm well aware that anything COULD happen, however, in my opinion it is not very likely to -- precisely because of our sordid history as a country. Yes, we do have laws to protect us, and that is the status quo. If you want to discuss fiction, you should say so.

Bringing up Pisa is fun. I won't comment on that particular study -- but I'll comment on your assumption that any score in such a comparative study would indicate knowledge about what happened in Germany in the last century. Every person out of school will have had that topic looked at from various angles, at length. It's a topic in history classes, foreign language classes, projects, politics classes, etc. in virtually every grade 5+. If you manage to miss all of that, you simply have not been in school -- and it's not sugarcoated. At least it wasn't in my region.

You assume that my knowledge of governmental powers is limited simply because you choose to disagree with my assessment of the situation w.r.t. data privacy laws ? Great argument ! Is everybody who disagrees with you less knowledgable than you ?

You might have misunderstood my use of Feindbild or I might have been unclear, but I was referring to your fascist regime reference, not to the current state of affairs. You are correct
in that Germany has US troops stationed on US bases here, though quite honestly, if Germany WERE
to want to wage war, those US troops would be overmatched by the Bundeswehr, easily (tiny advantage of having a mandatory draft) -- at least until a couple hundred k more troops were deployed stateside. Then again, war here would be madness, and not because of those troops being stationed nearby.

As for having something to prove; nope, Germany doesn't. Though to take the comparison to the US again (and this is really not a good comparison to make, looking at recent years), on the things you stated, it still "wins". Free speech exists, and is not limited to a "free speech zone" at political rallies. Critical remarks about antiterrorism tactics does not yield you visits by the FBI (and I don't

Re:worry about the German government first

[nguy]

Sources would be the BDSG (Bundesdatenschutzgesetz). Personal data of a special nature (religious affiliation is of that kind, specifically mentioned) gets even more protection.

http://www.gesetze-im-internet.de/bdsg_1990/BJNR029550990.html

In 14(2)(6), 14(2)(7), and 14(5)(1), that law effectively permits the use personal data collected by any government agency for police purposes, including highly personal information, like religion and sexuality. That's in addition to several other loopholes in that law that would make it possible for that data to be shared.

As for having something to prove; nope, Germany doesn't.

Whether other people trust Germans on issues of democracy, privacy, and freedom is not for Germans to decide, it's something Germans need to convince other people of. You aren't doing a good job, and I'm not convinced.

it does beat at least the spreader of democracy in the middle east

I don't see what those points have to do with anything. We're talking about whether a German government representative has much credibility when making statements about privacy and free speech, and I don't think he does, based on Germany's actual privacy situation.

As for US foreign policy, the responsibility of US politicians is to US voters alone. When the US "spreads democracy" (as it did in Germany and Japan), it's to serve US interests, nothing more.

Re:worry about the German government first

[mxs]

Neither 14(2)(6) nor 14(2)(7) apply without cause ("Präventive Strafverfolgung" in and of itself is not allowed as per PolG, "Straftatprävention" has to meet a proportionality-test as it affects article 2 GG). If your privacy is eroded without cause (i.e. Verdachtsmoment), you always have the option to seek recourse under Art. 2 GG. "Verdachtsunabhängige Datenerhebung" (i.e. data collection without existing suspicion) is not covered by these 14(1) exceptions -- this limits the scope further. 14(2)(7) does not apply to highly personal information at all (and to other data in criminal cases, subject to the note outlined above). 14(2)(6) does, and is indeed the loophole so-called anti-terrorism laws can exploit -- but even this exception has to meet the burden of proportionality as it directly affects Grundrechte; violations thereof can lead to "Nichtverwertbarkeit", i.e. unusability for prosecutory purposes. Then again, the damage has possibly already been done at that point.

Whether other people trust Germans on issues of democracy, privacy, and freedom is not for Germans to decide, it's something Germans need to convince other people of. You aren't doing a good job, and I'm not convinced.

My point is that it does not really matter whether /you/ trust or agree with Germany's rule of law or society -- Germans do not have to convince you -- much like US Americans do not need to convince others that theirs is the best system. The people AFFECTED by it are the ones that need to be convinced of it, or annoyed enough to do something about it.

You make that exact point in reply to my riffing on the many faults of the US (and there is an equally long list of praises). You made the point that Germany is much worse than other, more free deomcracies. I took the liberty of assuming that you'd consider the US to be one of those, for it's an unfair comparison for the current state of a society and government to be measured against some lofty, unattainable ideal -- it's much more earthbound to use a specific instance thereof. Since you mentioned democratic tradition and democratic values, it seemed only fair to bring up the current state thereof in that particular country.

I do enjoy this back-and-forth with you in any case. While I suppose we'll not be erring on the same side of the coin any time soon (and much of this is a matter of opinion, in any case), it's been refreshing.

Re:worry about the German government first

[nguy]

(i.e. data collection without existing suspicion) is not covered by these 14(1) exceptions

Section 14 doesn't talk about data collection at all; it talks about how government agencies can use data already collected by other agencies for new purposes. And evidently they do.

Neither 14(2)(6) nor 14(2)(7) apply without cause ("Präventive Strafverfolgung" in and of itself is not allowed as per PolG, "Straftatprävention" has to meet a proportionality-test as it affects article 2 GG).

You claimed that the police can't get at that data, and that's clearly wrong. Now you're only arguing about the conditions under which they can get at the data.

Since you mentioned democratic tradition and democratic values, it seemed only fair to bring up the current state thereof in that particular country.

Most of the points you raised aren't about freedom, they are about good governance. The fact that a nation is a democracy doesn't mean it's well governed or nice to its neighbors, and the US currently is neither. On the other hand, many well-governed and peaceful nations in history have not been democracies and have restricted personal freedoms.

In fact, I think that's the fundamental flaw with the German model: there's an inevitable tradeoff between safety, security, and comfort on the one hand, and liberty and freedom on the other, but Germans want it all. Germany has achieved comfort and safety, but at the expense of individual liberties.

My point is that it does not really matter whether /you/ trust or agree with Germany's rule of law or society -- Germans do not have to convince you -- much like US Americans do not need to convince others that theirs is the best system.

No, but Germany does need to convince other nations when it comes to making statements in the EU or UN. I think the EU and the US should tell any German data protection representative to go take a hike and get his own house in order first. And as far as the US is concerned, that's just what the US is doing.

(and much of this is a matter of opinion, in any case),

I wouldn't be so complacent about it. Germany hasn't faced any real challenges over the last half century. The last time things went bad in Germany was after a great depression. Whether Germany will be able to get through a halving of its living standard, collapse of the auto industry, and a 30% Muslim population, and come out democratic at the other end remains to be seen, because something like that is in the cards and Germany has historically not been able to get through any major crisis without the Germans throwing in the towel and changing their government.

Re:worry about the German government first

[Crayon Kid]

[..]Americans tend to be optimistic about this but Germans already have undergone two periods of oppression that relied on an extensive invasion of privacy.

That's why, in this context, the approach on topics such as mandatory ID's strikes me as strange in the two countries.

Most of the European countries, especially those that used to be behind the Iron Curtain, have grown used to mandatory ID's. When they finally got a taste of actual freedom and democracy they kept the ID's, but they also payed a lot more attention to possible abuse and privacy issues.

Whereas in the US, the very bed of democracy, the mandatory ID is regarded automatically as evil and Big Brother is the first thing the citizens think about.

It comes down to trusting your own Government to not abuse the personal data. So I find it ironic that former dictatorships and authoritarian states would be more trusted than a traditional democracy.

Re:worry about the German government first

[mxs]

14 implicitly covers collected data, as it talks about storage. Though yes, 13 is about the collection thereof, while 14 goes to the meat of the matter when we talk about access by law enforcement.

I claimed police could ge the data under lawful order from a judge, not that it was impossible for them to get it. In retrospect (while this does apply to private entity data collection), that was too strong a statement. There are, however, restrictions and usage-bound rules. It has been a while since I studied the BDSG in more detail; the point still remains that 24'esque huge centralized government databases accessible by any police officer is just not happening and unlawful.

As for my statements not being about freedom -- some of them were, some of them weren't. You brought up democratic values & tradition. Those do not equate to freedom, and never did I claim that. You brought it up as a point of comparison, and I submitted that these values and traditions exist more in Germany currently than they do in the US; don't throw with stones when sitting in a glass house, as they say.

There is always a tradeoff between the values the stated, in any society. In the US that scale has long since tipped in favor of curtailed or eradicated freedoms for some semblance of security (though even that, objectively speaking, cannot be achieved through the measures taken thus far or even in that direction).

In your mind, should somebody bring up a valid point, do you dismiss it out of hand because he comes from somewhere you do not like ? That's foolishness -- especially when we're talking about the EU. You mentioned the Vorratsdatenspeicherung earlier in this thread; you do know, of course, that that law is simply the transformation of an EG-Richtlinie into local law, that is, the mandatory collection and storage of that information is mandated by EU law, not originated from local law; in light of that, the EU telling Schaar to take a hike would be somewhat counterproductive, seeing as how your suggestion of cleaning up its own house would render it in conflict with the EG-Richtlinien requiring Germany's local legislative to do exactly the opposite.

As for the US telling the EU to take a hike, yupp, they do. Likewise, the EU can tell the US to take a hike when it comes to passenger data or SWIFT transaction data. It doesn't often, but it can.
Furthermore, the EU is not telling the US how to handle its internal affairs. The US is free to curtail the individual liberties afforded to its citizens however they damn well like, and to treat privacy as a token gesture devoid of any actual protection afforded to it. It doesn't need to tell Germany to take a hike, though it might do well to think about it every once in a while. (and no, the US is not telling the EU to take a hike but rather recognizes the difference in mandatory protection levels afforded, working on things like the US Safe Harbor Framework to facilitate business across its border).

A split Germany and a reunification thereof is no real challenge, eh ? Playing cards is fun, but really, the cards for the US hold some pretty horrid scenarios as well; one might argue some of them have already played out, and cynics might argue that only lip-service is being paid to democracy, anyway. Proclaiming a certain outcome as all-but-certain due to historic events of a region is foolishness, and hardly constructive; if you truly believe that history is doomed to repeat itself ad infinitum, what's the point in going forward ? Ah dammit, one of those philosophic questions without answers.
Let's see what happens, and act when appropriate. That's all anybody can do (but most people don't).

Re:worry about the German government first

[nguy]

submitted that these values and traditions exist more in Germany currently than they do in the US; don't throw with stones when sitting in a glass house, as they say.

Where do you think modern German values come from? Post-WWII Germany was shaped by the victors of WWII, its constitution was written under US supervision, it was de-nazified and re-educated under allied control, and Germany was integrated into a complex web of economic and military relationships. In fact, you might say that today's Germany is not so much an expression of German values, but of American values and traditions.

It looks like these values are being assimilated into German culture in general, but nobody knows how far along that process is. We do know that 16 million East Germans accommodated a totalitarian government for half a century and that support for the Nazis and anti-semitism in the 1950's was still disturbingly high.

In the US that scale has long since tipped in favor of curtailed or eradicated freedoms for some semblance of security (though even that, objectively speaking, cannot be achieved through the measures taken thus far or even in that direction).

No. Even with the post-9/11 changes, the ability of the US government to track and spy on Americans is much more limited than that of the German government, and many of those powers expire or are being overturned.

Proclaiming a certain outcome as all-but-certain due to historic events of a region is foolishness, and hardly constructive

What is "foolish" is to assume that things will just keep getting better. Whatever the cause, every nation experiences severe economic meltdowns periodically; the real question is how it gets through it. Post-WWII Germany has not lived through one yet, so we don't know.

We could have had the same discussion 90 years ago: the Weimar Republic looked like it was more progressive and democratic than the US. But, in fact, two decades later, Germany was a fascist dictatorship setting out to gas millions of Jews, while the US somehow muddled through again.

Re:worry about the German government first

[mxs]

It is true that the allied forces shaped Germany post-1945. It has to be recognized that the leadership of the allied forces at that time did some brave and brilliant things in order to not just end the war, but also help (re)build a society integratable into the day-to-day workings of the world. However, please don't paint it with a broad-brushed Americanization; The system is sufficiently different from what the US is modeled on, and the US is not the only allied force. It's also folly to assume that guiding the installation of a new form of government will suddenly eradicate anything and everything that was before. Yes, Nazi Germany was bad, yes, a major economic crisis made that possible, but no, democracy existed in these parts before it, with tradition. It was subverted and used to topple those very traditions -- and one also has to recognize the skill and execution of the NSDAP in taking over the country -- not by force, but with participation. It's a lesson many would do good to learn.

As for your assumed assimilation of values not being gaugable -- bullshit. There have been two generations since that time -- I can talk to my grandmother about it, but my children will not have that luxury anymore. These are not the same people. You can gauge the current state of this society with the same tools you'd gauge other societies with (and the same caveats).

As for East Germany "accomodating" a totalitarian regime ... Well, as you well noted, this is a product of the allied forces divying up the country. East Germany had no choice BUT to accomodate a totalitarian regime -- It was under the control of Russia, as agreed by the Allies. If you want to attribute the democratic values in Germany to the US, you have to attribute the totalitarian regime there to the exact same people -- there is not one without the other.

Anti-semitism still exists, and not "just" in evil Germany (if anything, the populace is a lot more sensitivized to that issue than it was 100 years ago). This, however, is not a German problem per se. Yes, 6 million jewish people were killed in the KZs, and that happened nowhere else. However, antisemitism was alive and "well" in the US just the same (and is, to this day -- as it is in Germany, in parts of the populace).
And yes, especially in the years after the war, denial was a coping mechanism for many. Some still use it to this day. It is impossible for many people who lived at that time to admit and submit to the fact that they did let it happen or even actively supported the atrocities committed. And yes, there are nazi-supporters still, or rather neonazis -- even radical ones -- not that this is unique either (looking at white supremacist groups elsehwere). Yet again, Germans, in general, are sensitivized to this issue.

No. Even with the post-9/11 changes, the ability of the US government to track and spy on Americans is much more limited than that of the German government, and many of those powers expire or are being overturned.

Oh please. National Security Letters ? "Secret" NSA wiretaps ? Nixon ? CIA operations inside the US ? Patriot I and II ? Sure, there are countercurrents to these efforts (as they do in the EU and Germany as well -- the Vorratsdatenspeicherung is being challenged before the supreme court, as is the requirement of mobile phone providers to record personal data when selling phone cards), but we are still talking about the status quo, not some rosy future state where all that crap has been abolished.
Expiring powers ? All it takes is another big scary explosion or another school massacre, or maybe a nice new Feindbild like Iran and suitcase nukes.

The past is past, the future is uncertain. You can't claim we'll be able to have this same conversation in 90 years with the same relative historic references. One should even consider the possibility that a repeated severe economic depression could propel the US into similar tactics and the EU having to bail them out (though nowadays we'd probably just nuke the pla

Re:worry about the German government first

[nguy]

However, please don't paint it with a broad-brushed Americanization; The system is sufficiently different from what the US is modeled on, and the US is not the only allied force

I didn't claim that Germany society was a carbon copy of the US, I said that German democratic values and traditions are largely derived from American ones (which are basically the same as the allied ones).

but no, democracy existed in these parts before it, with tradition.

Really? Like where? German intellectuals liked to talk a lot about liberty and democracy, but the only actual democracies were the result of WWI and WWII.

You can gauge the current state of this society with the same tools you'd gauge other societies with (and the same caveats).

I don't think anyone can gauge the state of a society. And that leaves us with history.

Oh please. National Security Letters ? "Secret" NSA wiretaps ? Nixon ? CIA operations inside the US ? Patriot I and II ?

That's the way US democracy is supposed to work. The president deliberately has broad powers, and Congress will defer to the executive in questions of war and defense. That's how the US survived the civil war, expanded across the continent, and got through the 20th century in one piece. But it's inevitable that the president will abuse his powers, as he has again and again over the past 200 years. But Congress and voters eventually reign it in. Landmark legislation, like FOIA, civil rights, and the Privacy Act have been the result. (Many nations, including Germany, then look to the US as a model for such legislation and enact their own versions without ever having to go through the wrenching scandals themselves.)

One should even consider the possibility that a repeated severe economic depression could propel the US

One should indeed, and that's why, overwhelmingly, Americans distrust their government and want as little to do with it as possible. What concerns me is that Germans don't seem to distrust their government anywhere near as much.

Re:worry about the German government first

[mxs]

True enough, the first proper democracy would be considered the Weimar Republic (which ultimately buckled under the depression).

The state of a society is influenced by its history, but you cannot derive its state thereof; That would require a mighty crystal ball (i.e. in how history is interpreted and used in that society). There are of course some ways do gauge the general trends in a society (pollsters make their living doing that, and some even have a scientific foundation). I couldn't paint a picture of any society with just history alone; it sets the surroundings, it doesn't force an outcome.

Questions of war and defense, I can see your point there. The ingenuity of it is the war on terror, which is a war on its own populace as well as defense therefrom. That's where stuff is going awry, IMHO. If that is how DEMOCRACY should work, then it is not democracy we are talking about; freedom of speech, of the press, and a rule of law (not martial law) are prerequisites -- eroding any of those three reduces the resulting form of democracy. While civil rights may have sprung from such controversies (which you describe as reigning them in), the reverse suddenly is forgotten ? In any case, democratic tradition and values these are not.

One final point on your last sentence. Apathy is not distrust. You distrust your government. Many are just apathetic towards it, or have lost trust in the entire system of governance (which is not distrust of the current government, but of governance in general); Declining voter participation is a sign of this (and 50% is abysmal by any standard already), and the ease with which many Americans give up their civil liberties because their neighbour COULD, after all, be a TERRORIST trying to KILL THEM DEAD is astounding. I'm not going to quote Franklin, but he did have a point.

Re:worry about the German government first

[nguy]

I couldn't paint a picture of any society with just history alone; it sets the surroundings, it doesn't force an outcome.

Neither can I. But I'm not saying that Germany is a bad democracy, I'm disagreeing with you that the world should look to Germany as a model of privacy protection and democracy. Germany has not faced a major crisis change since WWII, so nobody knows how it would hold up.

That's where stuff is going awry, IMHO. If that is how DEMOCRACY should work, then it is not democracy we are talking about; freedom of speech, of the press, and a rule of law (not martial law) are prerequisites -- eroding any of those three reduces the resulting form of democracy.

I think the same demand for perfection that makes German cars nice (but expensive to repair) has made German democracy brittle in the past. Democracy includes the ability of the government and citizens to screw up. The US government screws up all the time, but then things get fixed and the whole system improves as a result. Historically, when the German government screws up in a big way, the country falls apart.

Apathy is not distrust. You distrust your government. Many are just apathetic towards it,

I have no idea what you base that on. Have you lived in the US? I can make the comparison directly, and from everything I have seen, US participation in the political process is far more vigorous than it is in Germany.

(and 50% is abysmal by any standard already)

Voter turnout tells you little about the health of a democracy. The relatively low voter turnout in the US (comparable to Switzerland) results from the political process selecting candidates in such a way that a large percentage of the population simply has no preference between them and doesn't need to vote anymore by the time the election comes around. In different words, the real US presidential election is happening right now, and the choice in November will likely be between two fairly middle-of-the-road candidates (middle of the road = conservative by German standards).

It's actually a good system. If the Weimar Republic had had a US-style voting system, Hitler would likely never have come to power: too much dirt would have come out on him during the primaries, and he would have been too controversial a choice to make it into the actual election.

Re:worry about the German government first

[mxs]

I'm not advocating that the world be modeled after German governance, nor adopt all its laws. To suggest so is ridiculous. Nevertheless, to dismiss an analysis by Mr. Schaar out of hand just because he is from Germany, well-versed in the intricacies of data protection (it's his job), and an expert in the field (it's his job and he's well-recognized in that capacity), is equally patently ridiculous. The rights afforded to German citizens w.r.t. data protection are of a higher base level than those afforded to US citizens by law, as per right now. That is still beside the point, however, since it does not affect intellectual discourse about the issue, and neither can one seriously claim that Mr. Schaar has no idea what he is talking about and thus his testimony or advice not be heard.
I'm also not advocating the German system of government to be the best thing since sliced bread. It's not. It may not be the best in the world, it is definitely not the worst, but you brought up comparing it to other, "freer" (sic) systems, so that's what we arrived at.

Certainly, the German government screws up. Politicians have a knack for screwing up. Things get fixed, and hopefully the result will be better than what was before. I don't believe the US has a monopoly on that particular front (nor has that particular mechanism been working over there, recently, IMHO).

Yes, I have lived in the US for a while, though as you probably have guessed, I am native to Germany (and currently live there). As for where I get those numbers from ... Voter participation is a matter of public record. A quick google-search gives us http://www.infoplease.com/ipa/A0781453.html for the US, http://www.bpb.de/wissen/C11SZM,,0,Wahlbeteiligung_nach_Altersgruppen_1953_%96_2002.html for Germany (on the federal level). Personally I consider it a duty of any citizen of my country to vote come election day, even if that means going out of your way to accomplish such; that's been my upbringing. I'm sad to say that over the past few decades the trend is declining a bit, but a 50% participation is unheard of.
As for participation in the political process in everday life ... I wouldn't compare vigorousness in general, since I can base it only on my surroundings, and that's, by definition, anecdotal. I know politics comes up a lot in conversation here and rarely have I seen talking-point conversations I've been privy to in the US (i.e. Democratic talking point vs. Republican talking point ad infinitum without any discussion taking place); not all of them were that way, of course, but a lot of political discourse was structured in that manner. In any case, political discourse is not dead here, and I assume it's not dead in the US, either (even in the College crowd, though more often than not, Steward and Colbert are cited rather than newspapers; I love those two guys for their satire is exquisite, though :)

Politics lives from controversy. The current US system during the primaries is a great theatralical production, but the often-touted "let's talk issues" is a talking point, nothing more. It's telling that politicians have to preface their statements about issues with a statement that they are about to talk about issues and not personal shortcomings of their opponents, rather than present a political platform they stand on and let that speak for them.

I find it interesting that you seem to consider low voter turnout a good thing, and the reason given for it. By the time that ballot would be cast, sure, a lot of "controversial" choices are weeded out (namely anybody not openly touting their Christianity, anybody without either huge coffers or the backing of one of the two (TWO!) parties, anybody the common Joe would not want to drink a beer with some time, etc).
In any case, the turnouts for the primaries are not looking parti

Re:worry about the German government first

[nguy]

issue, and neither can one seriously claim that Mr. Schaar has no idea what he is talking about and thus his testimony or advice not be heard.

Where do you get that from? Of course, his testimony should be heard. I'm saying people need to look at his and Germany's record and not just believe the German myth that Germany has strong data protection laws.

I find it interesting that you seem to consider low voter turnout a good thing, and the reason given for it.

Where do you get that from? I said "Voter turnout tells you little about the health of a democracy. The relatively low voter turnout in the US results from..." Voter turnout is a meaningless criterion of democratic values.

By the time that ballot would be cast, sure, a lot of "controversial" choices are weeded out (namely anybody not openly touting their Christianity, anybody without either huge coffers or the backing of one of the two (TWO!) parties, anybody the common Joe would not want to drink a beer with some time, etc).

That's the choice the American people are making, quite democratically, and it's served the US well for 200 years. Besides, one of the major parties in Germany is the Christian Democrats, and German federal and state governments involve church officials in politics; talk about a disturbing non-separation of church and state.

As for "two parties", the existence of multiple parties was a big factor in the downfall of the Weimar Republic. What do you think having more than two parties accomplishes? Can you point to any historical examples showing that having more parties results in better democracy?

In any case, the turnouts for the primaries are not looking particularly well, either. A cursory glance at turnout figures for 2004 did not look better than those of the general election; by your argumentation, those should have been a lot higher, if this is where the real voting happens.

There is no "real voting", not even in Germany. By the time the vote happens, candidates and their positions will already have self-selected based on polls.

Personally I consider it a duty of any citizen of my country to vote come election day,

And personally, I consider it a duty for any citizen that hasn't informed himself on the issues and candidates to stay home and not vote. Furthermore, I don't see any problem with people not voting who don't have a preference. I certainly don't vote when I don't have a preference.

The current US system during the primaries is a great theatralical production, but the often-touted "let's talk issues" is a talking point, nothing more.

That's not the part that counts; what matters is the extensive political analysis, statements, vetting, and endorsements.

I don't believe the US has a monopoly on that particular front (nor has that particular mechanism been working over there, recently, IMHO).

Why do you keep responding to points that I never made? I pointed out to you that the US has a long history of fixing its political problems, hence your criticism of US politics is unwarranted, nothing more.

But since you mention it: what kinds of important legislative innovations has Germany actually contributed to the world? The US kickstarted widespread adoption of FOIA, data protection, free-speech, privacy, and civil rights legislation.

Re:worry about the German government first

[mxs]

Where do you get that from? Of course, his testimony should be heard. I'm saying people need to look at his and Germany's record and not just believe the German myth that Germany has strong data protection laws.

So you did not imply for the EU and the US to tell him to go take a hike, get his house in order first before he can make a valid point one should listen to ?


Where do you get that from? I said "Voter turnout tells you little about the health of a democracy. The relatively low voter turnout in the US results from..." Voter turnout is a meaningless criterion of democratic values.

You said it was a good system, that is where I got that from; that would imply that you either like the way things are, or that voter turnout is completely irrelevant.

That's the choice the American people are making, quite democratically, and it's served the US well for 200 years.

So a low turnout at both the presidential elections and the primaries is a good democracy ? Yes, you are right, voter turnout is by far not the only nor the one true best measure of the state of a democracy, but it sure does tell you a bit about participation.
Democracy constantly changes, and I'd argue nothing changed it more than research into the human psyche, and application of lessons learned therefrom. The combination of mass media, insight into Freudian theory, and the proliferation of public relations specialists (i.e. spindoctors) changes the equation somewhat, and gives a lot of power to very few unelected people (that's something Nazi Germany employed quite successfully, the manufacturing of opinion through the media and the press). Nobody dares mention "Gleichschaltung" in the context of US mass media, but then again, it's coming close. I dare question whether that has to do much with democracy. Of course, the informed voter is an utopian fantasy as well.

Besides, one of the major parties in Germany is the Christian Democrats, and German federal and state governments involve church officials in politics; talk about a disturbing non-separation of church and state.

The CDU (Christlich Demokratische Union) / CSU (Christlich Soziale Union), the strong conservative party in Germany, indeed bears Christianity in its name. Do not judge a book by its cover. They do not have a monopoly on "Christian" values, nor are all its members Christian. It is not a violation of the separation of church and state to have a political party with Christ in its name; The "church" does not write its agenda, and one might
rightly argue that their party program is anything but good'ole Christian.
Federal and State governments involve church officials in politics ? Well yeah. They are public figures. It may surprise you to know that this does not give church officials political power any more than lobbying groups get (they are also involved in politics), or advisors get. Quite decidedly they do not make policy.
Religion is a major part of society, and churches are an extension of that part. Of course that part of society needs to be integrated into everyday life, or rather, is integrated. The state does not exist in a vacuum, nor does the church. Appointed officials in politics have no right to appoint the head of a church, nor do church officials have have any power over appointment of government officials.

As I said; in Germany, we don't have an "Intelligent Design" vs. "Evolution" "debate". Schools are state-run.


As for "two parties", the existence of multiple parties was a big factor in the downfall of the Weimar Republic. What do you think having more than two parties accomplishes? Can you point to any historical examples showing that having more parties results in better democracy?


It can result in a better representation of the interests of its constituents. Yes, a multi-party system can fail. No, it does not have to. Coalitions can be formed.
In my mind it is folly to assume that a voter can have exactly one of two positions on any issue,

It's Peter SCHAAR

[Doctor O]

His name is Peter Schaar, not Scharr. One would think the editors would at least *skim* TFA.

Oh, and he's a great guy BTW, responding to email in a timely and thoughtful manner, and investigating the questions he's being asked.

Re:It's Peter SCHAAR

[Anonymous Coward]

His name is Peter Schaar, not Scharr.

And the posting is correctly tagged as concerning schaar, not scharr[1].

One would think the editors would at least *skim* TFA.

But to no avail, alas. It's The Washington Post's fault.

[1] Which means to dig in German. By the way, the word schaar doesn't exist as such, but I think Peter Schaar's name stems from Schar, which means group of people. Therefore, I think, his name is apt for his position. ;)

Re:It's Peter SCHAAR

[Doctor O]

And the posting is correctly tagged as concerning schaar, not scharr[1]. I know, because I tagged it as such, and I guess several others followed me in this, either because they're German and know Mr Schaar, too, or because they've read my comment.

I think Peter Schaar's name stems from Schar, which means group of people. Might be, then again I went to school with someone whose name was also Schaar, and he told me it was of Dutch origin and had to do with some medieval profession, but I don't remember which it was. Maybe someone from Benelux can elaborate. ;)

Re:It's Peter SCHAAR

[Anonymous Coward]

And the posting is correctly tagged as concerning schaar, not scharr[1]. I know, because I tagged it as such

OK, that explains the tag

I think Peter Schaar's name stems from Schar, which means group of people. Might be, then again I went to school with someone whose name was also Schaar, and he told me it was of Dutch origin

A quick search produces http://nl.wikipedia.org/wiki/Schaar. Well, my Dutch isn't perfect (I don't understand any), but reasoning from the images shown there it seems to be scissors.

and had to do with some medieval profession, but I don't remember which it was.

Maybe it was a tailor. ;)

Now that I've become completely off topic: "Schere Dich zum Teufel, Anonymous Coward!" :)

There's a girl next door to me

[Anonymous Coward]

Do you mean her?

Steal and abuse...

[Anonymous Coward]

Somebody may have a compromised system which will be use to perform toxic actions without its consent.
You cannot link "for sure" an IP with somebody actions.
Beware! Here is an analogy to hint people on my way of thinking (never argue on analogies since contexts are always different) : A lent its car to B with generosity, B smashes C with A's car, B is responsible for hurting C, not A.

Or A opens its wifi network to anybody by generosity, B uses A wifi network to hack C's system. Well... C should have have GNU/Linux. :)

How will this affect Wikipedia?

[ta bu shi da yu]

Wikipedia records IP addresses for all anonymous editors. I wonder how this will affect the project?

Re:How will this affect Wikipedia?

[JasterBobaMereel]

Yes but...

1) Wikipedia is US based so these laws do not apply (they do not have the data protection act)

2) Wikipedia states on it's edit screen that everything you submit will be covered by the GNU Free Documentation Licence and so the people who IP address have been logged have voluntarily given up their rights by submitting ...

Re:How will this affect Wikipedia?

[Curmudgeonlyoldbloke]

Taking the second point first, I don't think that it's relevant - the ICO's "Facebook decision" would apply just as much to Wikipedia anonymous edits as to Facebook:
http://news.bbc.co.uk/1/hi/7196803.stm

However, regardless of where a company is based, the link above suggests if they're "established" in the UK they're subject to law in the UK (presumably the law of whichever bit of the UK they're established in). Presumably it is up to a court has to establish that. In the case of someone with an actual address or mailing address in the UK, that should be easier than with someone who just sells services or advertising here from elsewhere. Wikipedia doesn't even do either of these (yet), and even if they did I can't see anything more than a slap on the wrist happening anyway.

IPv6

[todslash]

Won't a byproduct of IPv6 be that everything will have a unique IP address and so become even more of a unique identifier.

And because there will be so many addresses I'm guessing that they won't get recycled very much at all.

Data Protection

[stevenmu]

Wow, even for /. there's a lot of people who didn't even read the summary, let alone TFA. And there's a lot of FUD being spread. What this means is that IP address information might be considered personal data under EU data protection laws. This means that companies/corporations/organisations which log your IP address will have to have a privacy policy in place governing how that information is used. There are also certain requirements, such as they have to make people's own information available to them if requested, they have to disclose breaches of information to those affected and so on. It doesn't stop logging IP addresses, it won't stop webservers using client IPs to maintain statefull connections, it won't stop google associating IP addresses with search data, it won't stop wikipedia or forums storing the IP of posters. It just means that organisations doing this need need a privacy policy in place to protect this data (which most of them already have to protect other private data they store). It's just acknowledging that IP addresses can/may be used, in some cases (the summary points out that they already acknowledge IP addresses are often dynamic), to identify a person and deserves the same level of protection that things like phone numbers and home addresses already have.

Yahoo Germany Helpdesk

[Anonymous Coward]

Helpdesk: "Hello, this is the Yahoo Germany Helpdesk"
Caller: "Yes, I want you to delete all your records with my IP address in it..."
Helpdesk: "OK"
Caller: "and I want you to tell me who gave you my IP address."
Helpdesk: "Umm, well your computer will have sent us your IP address when you connected to the website"
Caller: "Oh, I don't think so, I have a very good firewall."

Helpdesk: "Hello, this the German National Bank Helpdesk"
Caller: "Yes, I want you to delete all your records with my IP address in it..."
Helpdesk: "Sure, and what is that IP address?"
Caller: "10.0.0.10"

Helpdesk: "Hello this is Ebay Germany, how can I help you."
Caller: "Could you please delete all records relating to my IP address."
Helpdesk: "Sure, do you know what the number is?"
Caller: "Didn't you make a note when you recorded it!"

Exceptions to law

[Benjamin_Wright]

Even if EU privacy law says IP addresses are protected personally-identifiable information, there will be instances where citizens are legally justified in processing and recording those addresses.

That's insulting!

[SanityInAnarchy]

How dare you compare the fine folks at The Onion to Fox news!?

IP addressare NEVER linked to a user

[geekoid]

always a computer. Always.

If you read just one comment, read this one.

[Flambergius]

First: This is a good thing. It is a good thing especially for the individual.

Second: This is how things have been always been in most of Europe. The commissioner didn't change a ruling, he just said that he agrees with the consensus view. (Of course I don't know what the situation is in every European country, only for the ten or so.)

Personal data doesn't mean private. If fact, in many cases it is the opposite of private. In European practice, an individual has control over their own personal data. To use your personal data, I need your permission. Sometimes this permission needs to be implicit, as in using an IP address number to enable real time communication between two computers. In cases where the permission doesn't need to be implicit it isn't. An example would be if I wanted to store your IP after the real time communication between has ended. To be able to do so, I would have to tell you at the first opportunity that I am going to store your IP, what I'm going to do with it and how I'm going to protect it from other people. (Logging just for operational purposes is considered a special case, not requiring an explicit declarations, but that sort of assumes that your logging practices fall within the industry norms. Best thing would be to inform your user about your logging practices in any case.)