Slashdot Mirror
E.U. Regulator Says IP Addresses Are Personal Data
NewsCloud writes "Germany's data-protection commissioner, Peter Scharr told a European Parliament hearing on online data protection that when someone is identified by an IP, or Internet protocol, address, 'then it has to be regarded as personal data.' Scharr acknowledged that IP addresses for a computer may not always be personal or linked to an individual. If the E.U. rules that IP addresses are personal, then it could regulate the way search engines record this data. According to the article, Google does an incomplete job of anonymizing this data while Microsoft does not record IP addresses for anonymous search."
The only way to check and see if your IP is being kept is by changing the protocol entirely or by checking the company's servers. I'm guessing that not too many companies would appreciate people routinely rooting around, and if something to check if an IP is stored were to be implemented, the protocol would have to be vastly overhauled and it could slow down the internet 80% or more because of the extra time needed to "check."
The bottom line is this is much like the ruling in the US that companies had to keep a record of working memory (which is entirely impossible,) This seems to be more legislators talking about something they know very little about.
Don't get me wrong, I do appreciate the fact that it would make it harder for the ad industry to hunt you down which is always appreciated, I just don't think any reasonable implementation will work.
Well, back to rejecting software patent applications.
There's no European equivalent to RIAA... maybe there's such an organization on a country level, but I can assure you that sharing is completely legal in Spain, since fair use covers any kind of private copy, no matter whether you own the original or not (and yes, P2P falls into that category).
My 0.02 cents
Your name is personal data, but not private.
Your phone number is personal data, but not private.
Your Address is personal data, but not private.
And of course, your IP is not private... but is part of your personal data.
Maybe in USA there is no difference between private and personal data, but in EU there's a big difference: nobody can NOT store your personal data without warning you and giving methods to correct AND ERASE your data.
His name is Peter Schaar, not Scharr. One would think the editors would at least *skim* TFA.
Oh, and he's a great guy BTW, responding to email in a timely and thoughtful manner, and investigating the questions he's being asked.
Who is General Failure and why is he reading my hard disk?
You're assuming the restrictions on personal data are greater than they are. If IP's are judged personal data, that makes them like a telephone number or an address (The Act covers any data which can be used to identify a living person). Still, you do have some responsibilities, *if you're in the EU* with regards handling personal data. Basically, there are restrictions on publishing it or sharing it around without permission, and you can only use it for the original purpose for which it was collected. (Sensitive personal data, i.e. really private stuff, is more strictly controlled)
For example, say you were to publish your webserver access logs; you'd be better off anonymising the IP's somewhat first. Just as if I call you on the phone, you're allowed to store the caller ID, call me back or even put me on your internal call-list - but publishing my phone number, along with transcripts of our conversations without permission would be a no-no. Nor can you flog it off on the open market to cold callers. When you sign up for a phone line here, you're asked if you want the number to appear in the phone book, or go ex-directory.
Again, this only applies if you live in an EU country with data protection laws.
If IP addresses are personal data, and you visit my web page, and my access logs show I served an IP that you used at a certain time (or even just that I served an IP you used), am I now subject to laws regarding the holding of personal information?
If you're an individual holding the data for your own personal use, you are exempt from much of the data protection act, including having to tell people when they ask what data you hold on them. If you're a company, when given a proper request and the fee to handle the request, would have to look in the logs when given the IP, and would have to report that yes, you hold 7 instances of that IP in your log. If your log expires before you have to answer the request (40 days I think) , you don't have to give anything.
If you were to contact me and request that information how would I authenticate you? If I was to disclose certain parts of the "personal data" that you claimed belonged to you,how could I know that I was not disclosing someone else's personal information, given that I can't necessarily authenticate you or anyone else and IP's can be re-allocated?
You don't have to disclose the other data that goes with the IP, just the IP itself that they supply to you. You then say whether you hold that or not.
If I ban an IP address for abusing my server and it is later re-allocated to someone else, is that slander?
It'd be libel as it's written, not slander as that's spoken. Libel only applies if you *publish* lies about someone, such as 'this IP searches for goat porn' (when they don't). Storing it for your own blacklist is fine. If you're a company, the new holder of the IP could ask that you correct your record under data protection law though.
If I forward an e-mail whose headers contain IP addresses of relay servers, is that unlawful disclosure of personal information?
No, because relay servers do not identify a living human. Also, it's the processing and storage of personal identifying data for later use that's covered, not mere transmission. The owners of servers that store those emails would likely have responsibilities under the data protection act, but then they do anyway because of the contents of the email itself!
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
Yup, in my country whenever a car is shown on a news report for example they blur out the registration number. This is in line with data protection legislation of the late 90s.