Companies which are unsure whether information such as activity
or server logs or a record of internet protocol (IP) addresses are
personal data or not should treat it all as personal data, the
European Union's Data Protection Supervisor Peter Hustinx has
said.
There has long been confusion about whether or not companies
which process individuals' IP addresses and use them are bound by
the requirements of the EU's Data Protection Directive.
The Directive demands that companies only store information for
the same purpose as that for which it was collected, and delete it
after it has been used for that purpose.
Search giant Google has long argued that while IP addresses can
count as personal data in some circumstances, they will not always
be so.
Hustinx, who is charged with advising EU institutions on privacy
law and ensuring they comply with it, has said in a video published
by technology news service ZDNet that companies that gather
addresses that might or might not be personal data should just
treat them all as personal, with all the restrictions that
entails.
"All European data protection authorities together have made the
case unanimously that much of what Google is doing is about
personal data. Maybe not always, but if they are not able to
distinguish one from the other then they should treat all that
information as [if] it were personal data," he said. "It's a
scholastic discussion. For practical purposes the safeguards should
apply."
Google has made a number of concessions on the retention of IP
data from users' searches on its search engine. It first limited
the retention to two years, then 18 months and, earlier this year,
nine months.
It said in September, though, that it believed that much of its
processing of data was not covered by EU law because it is
ultimately controlled by its US parent company.
Hustinx insisted that much of the activity for which IP
addresses is used does make the data personal data.
"Behavioural advertising – you focus on the behaviour of
targets, that [means] the more value, the more likely it is
personal data," he said. "It is a contradiction to argue that it is
not personal data."
Hustinx was speaking to ZDNet at last week's RSA information
security conference in London. He said that for IP addresses to
count as personal data there was no requirement that the processing
company know the name of the individual whose activity it was
monitoring.
"Identifiable in the sense of the word personal data is singling
someone out. We do not need to know someone's birth date, address,
surname, first name etc," he said. "So if we deal with a computer,
an IP address, which is showing special behaviour in terms of the
transactions we can follow, then in a reasonable world that is
individuals. Computers do not do this alone, this is individuals
using this."
"It is a mistake to assume that under these circumstances the
data protection rules do not apply," he said.
A court in Munich last month provisionally ruled that IP
addresses could only be personal data when they were tied to named,
identified individuals.
Hustinx disagreed, saying that identification did not need to be
the same as naming.
"If you go to the details of the decision you see that the
criteria applied were confused," he said. "They say that the
information does not allow someone to be identified. Well,
identification does not need to happen on the basis of one IP
address only. Does it relate to someone who is identifiable either
to the controller or to someone else, using reasonable
standards?"
Hustinx also said that he had doubts about the degree to which
data which companies claim has been rendered anonymous is truly
stripped of all identifiable information.
"I think there are ways to do this in an acceptable manner so I
am willing to accept methodologies to anonymise, but my experience
is that there is a huge grey zone and many companies are
interepreting this in a way that is favourable to them and are
underestimating the scope of the law," he said.
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
