EU Body Says IP Addresses are Personal Information

At a Civil Liberties Committee hearing on Data Protection on the Internet, the European Union Data Protection Working Party (Working Party), comprised of national data-protection commissioners, has confirmed its view that Internet Protocol (IP) addresses are personal data, defined as "any information relating to an identified or identifiable natural person". In Opinion 4/2007 on the concept of personal data, the Working Party has adopted an opinion (Opinion) the central finding of which is that data protection rules should be applied where IP information relates to individuals who are identifiable. Applying this principle, an IP address would not be considered personal data if an individual user was not identifiable at the IP address, such as would be the case at an Internet café. But because an ISP could not distinguish between those two scenarios, the Working Party recommended treating all IP addresses as personal data. The treatment of IP addresses as personal data could pose significant challenges for Internet companies which track IP addresses to provide services, such as search engines, or which track on-line behaviour for marketing purposes. Some Internet companies, such as Google, argue that an IP address identifies a computer's location, not an individual user, and that therefore information relating to the location cannot be "personal". Privacy advocates have recommended fuller disclosure to Internet users by service provider companies about the use of users' personal data. For further information, see: http://tinyurl.com/yoy7e4 For information on the Civil Liberties Committee hearing on Data Protection on the Internet, visit: http://tinyurl.com/yoolkp http://tinyurl.com/39pk8q For the text of Opinion 4/2007 see: http://tinyurl.com/2ql3ng Summary by: Lauren Lodenquai