Slashdot Mirror
Your Dynamic IP Address Is Now Protected Personal Data Under EU Law (arstechnica.co.uk)
Europe's top court has ruled that dynamic IP addresses can constitute "personal data," just like static IP addresses, affording them some protection under EU law against being collected and stored by websites. ArsTechnica UK adds: But the Court of Justice of the European Union (CJEU) also said in its judgment on Wednesday that one legitimate reason for a site operator to store them is "to protect itself against cyberattacks." The case was referred to the CJEU by the German Federal Court of Justice, after an action brought by German Pirate Party politician Patrick Breyer. He asked the courts to grant an injunction to prevent websites that he consults, run by federal German bodies, from collecting and storing his dynamic IP addresses. Breyer's fear is that doing so would allow the German authorities to build up a picture of his interests. Site operators argue that they need to store the data in order to prevent "cybernetic attacks and make it possible to bring criminal proceedings" against those responsible, the CJEU said.
I've waited 10 years for this!!!!!
Well, it looks like practically every default logger for Apache/Nginx/etc. can be considered NSA spyware according to this edict.
That means you too, Slashdot.
AntiFA: An abbreviation for Anti First Amendment.
"Site operators argue that they need to store the data in order to prevent "cybernetic attacks and make it possible to bring criminal proceedings" against those responsible, the CJEU said."
Excuse me, but did you just say you want to prevent *cybernetic* attacks?
It is 'reasonable' that your IP address is considered personal information 'offered' to the web sites in question.
What this law 'should' mean (I can't speak for the wording specifically) is that a site's owner should treat a user's data as privileged, meaning it isn't handed out to others without reasonable justification. Law enforcement should still be able to subpoena these records as they probably have been able to in the past. My hope is that the law makes it harder for 'non-subpoena' requests for a given user's IP address harder to obtain since it would now be a privacy violation to disclose it.
That's all fine, but as the blow-back illustrates, just because an IP address makes a physical connection with a service you're hosting, it doesn't mean that said service is in any way being transmitted by the person in question. DOS attacks happen all over the place, and unless you have services which share information about these attack vectors, its significantly harder to track and get take-downs of the offenders (maybe I'm being too optimistic..).
Maybe the best trade-off is when an IP address is logically tied to further information from the site (site profile, name, email, etc..). If so, the information is considered 'personal information' while a random drive-by DOS is just considered infrastructure data.
Bye!
You are looking at it wrong: an ip is protected personal data that can be used to sue a Jane/John Doe, the ISP has the missing data for the plaintiff.
"an IP Address is like a physical address on a house: it does not identify a person"
Would you be ok with any business giving away your home address however they saw fit?
Ninjas don't carry tic tacs
Already happens with the junk mail I get addressed to me and the fact my name and address are public record for company filings and whois records.
I don't see why anyone else should be exempt if I'm not.
Change is certain; progress is not obligatory.
I can see your IP! So can the entire Internet. That's how it works. Packets are like post cards. You can write secret code on a post card, but the return address and the sender have to be out there because.. that's how it works.
If a bunch of people send me post cards, I can put their addresses in a file. They sent me post cards. If they didn't want their address in my file, they shouldn't have done that.
I don't think this is the most clueless thing the government ever said. They can, and perhaps should, regulate some retention rules on this information for corporations; but by default the IP is out there for everybody to see. That's how it works.
What about ISP that use NAT? In this case many users have the same ip address. Public WiFi hotspots usually have one ip address in Internet for its clients. I don't think that site owner can easy get information about persons that used some IPs from ISP, when users didn't some bad things.
The ruling is somewhat laughable depending on what sort of dynamic address we are talking about here. If it is an address from RFC1918 - something like 192.168.7.11, then it's really silly, given that it's the address of any number of people in that number of separate networks. If it's a public /128 IPv6 address, I see the point - although given that a subscriber would usually get at least a /64, question that would arise - why not protect that entire /64 subnet?
I'm the only one living in my house and I have a static IP address. Both my physical address and my IP address do identify me. You cannot know just by looking at them whether they identify a person, and that by itself should already be reason enough to treat them as potential personal data. That said, you're being inconsistent. Date of birth does not identify a person. Date of birth in combination with other facts may. Party affiliation does not identify a person. Party affiliation in combination with other facts may. A physical address does not necessarily identify a person. That same address in combination with other facts may. An IP address does not necessarily identify a person. That same address in combination with other facts may.
Sorry, you can't store it, it's personal protected data!
So if Dynamic IPs are now in that category, does it remove the "you can't prove it was me using my internet connection" defense?
Sort of like how my physical street address is property of the municipality, my phone number is property of the phone company... etc.
I do not own any of the information that could potentially be used to track me down unless I can live entirely independently of using property that belongs to other people.
File under 'M' for 'Manic ranting'
> I thought my IP address was the property of my ISP.
It is explicitly NOT. The agreement an ISP signs to get numbers includes these terms:
--
Legacy Holder acknowledges and agrees that: (a) the number resources are not property (real, personal, or intellectual) of Legacy Holder; (b) Legacy Holder does not and will not have or acquire any property rights in or to any number resources for any reason
---
See also:
https://www.arin.net/policy/nr...
The most important practical implication of that fact is that ARIN can, under the contract, revoke IP assignments from ISPs that aren't actively using them.
> my phone number is property of the phone company
Two words: Number Portability.
"an IP Address is like a physical address on a house: it does not identify a person"
Would you be ok with any business giving away your home address however they saw fit?
Like... a phone book?