Nameless data can still be personal

[Andrew Cormack]

> -----Original Message-----
> From: ukcrypto-admin@chiark.greenend.org.uk [mailto:ukcrypto-
> admin@chiark.greenend.org.uk] On Behalf Of Joel Harrison
> Sent: 08 November 2008 14:32
> To: ukcrypto@chiark.greenend.org.uk
> Subject: Re: Nameless data can still be personal
>=20
> On 7 Nov 2008, at 16:33, Roland Perry
> <lists@internetpolicyagency.com>
> wrote:
>=20
> > In article <49140FD9.2060105@iosis.co.uk>, Peter Tomlinson
> > <pwt@iosis.co.uk> writes
> >> "A person does not have to be identifiable by name for details
> of
> >> their
> >> computer usage to be protected by data protection laws, a senior
> >> European privacy watchdog has warned."
> >>
> >> "Companies which are unsure whether information such as activity
> or
> >> server logs or a record of internet protocol (IP) addresses are
> >> personal data or not should treat it all as personal data, the
> >> European
> >> Union's Data Protection Supervisor Peter Hustinx has said."
> >>
> >> Full article at http://www.out-law.com/page-9563
> >
> > This has been their position for almost ten years [1] (so there
> isn't
> > really any "long standing confusion", I'm afraid).
> >
> > In the EU we say "some IP addresses identify people, so we should
> > treat
> > all of them as personal data", whereas our friends in the USA say
> > "some
> > IP addresses cannot be used to identify people, so none of them
> need
> > be
> > treated as personal data".
> >
> > A fundamental difference of approach, and as is often the case in
> hi-
> > tech, people often hear about rules/laws and forget they are USA
> ones.
> >
> > [1] "The use of the infrastructure is often directly based on the
> > processing of personal data, such as certain Internet Protocol
> > addresses."
> >
> >
> http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/1999/wp16e
> n.pdf
> >
> > and also references in Opinion 136 by the Article 29 Working
> Party. In
> > particular example 15 on page 16:
> >
> >
> http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp136
> _en.p
> > df
> > --
> > Roland Perry
> >
> It's worth noting that the UK is out of step with much of the rest
> of
> the EU on this point.  In the UK an IP address will usually not be
> personal data, other than in the hands of the user's ISP or law
> enforcement officials, because the person processing the data lacks
> the necessary information to identify the user.

Joel
If you have a reference for the fact that IP addresses aren't personal
data in the UK then I'd love to know it.

As far as I can see the only difference in the text of UK and EU law is
that the UK has an additional "likely", when saying that the information
has to be linkable either itself or in association with information
likely to be available to the data controller. So it appears that we may
be slightly less strict than the directive in allowing highly unlikely
circumstances (e.g. you buy the disk containing the linking information
on eBay...) to influence whether or not something is personal data.
However the Article 29 WP's guidance seems to suggest that such unlikely
events are not sufficient to make the information personal, so they may
be reading in some likelihood test anyway.

This also seems to be the logic of the Munich court, in finding that it
would require a breach of the law (by the ISP) for a server operator to
learn the identity of the temporary owners of IP addresses, and that is
apparently either impossible or unlikely in Bavaria...

Incidentally *anyone* who controls personal data is a data controller:
there doesn't have to be just one DC for each item of personal data. So
if personal data escapes from its original controller, in a form that
makes it still personal, then as far as I can see the recipient is a
data controller too.

Andrew


JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024=20
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG