Feeds

Hustinx: Nameless data can still be personal

Treat it as personal if you're not sure

Top 5 reasons to deploy VMware with Tegile

A person does not have to be identifiable by name for details of their computer usage to be protected by data protection laws, a senior European privacy watchdog has warned.

Companies which are unsure whether information such as activity or server logs or a record of internet protocol (IP) addresses are personal data or not should treat it all as personal data, the European Union's Data Protection Supervisor Peter Hustinx has said.

There has long been confusion about whether or not companies which process individuals' IP addresses and use them are bound by the requirements of the EU's Data Protection Directive.

The Directive demands that companies only store information for the same purpose as that for which it was collected, and delete it after it has been used for that purpose.

Search giant Google has long argued that while IP addresses can count as personal data in some circumstances, they will not always be so.

Hustinx, who is charged with advising EU institutions on privacy law and ensuring they comply with it, has said in a video published by technology news service ZDNet that companies that gather addresses that might or might not be personal data should just treat them all as personal, with all the restrictions that entails.

"All European data protection authorities together have made the case unanimously that much of what Google is doing is about personal data. Maybe not always, but if they are not able to distinguish one from the other then they should treat all that information as [if] it were personal data," he said. "It's a scholastic discussion. For practical purposes the safeguards should apply."

Google has made a number of concessions on the retention of IP data from users' searches on its search engine. It first limited the retention to two years, then 18 months and, earlier this year, nine months.

It said in September, though, that it believed that much of its processing of data was not covered by EU law because it is ultimately controlled by its US parent company.

Hustinx insisted that much of the activity for which IP addresses is used does make the data personal data.

"Behavioural advertising – you focus on the behaviour of targets, that [means] the more value, the more likely it is personal data," he said. "It is a contradiction to argue that it is not personal data."

Hustinx was speaking to ZDNet at last week's RSA information security conference in London. He said that for IP addresses to count as personal data there was no requirement that the processing company know the name of the individual whose activity it was monitoring.

"Identifiable in the sense of the word personal data is singling someone out. We do not need to know someone's birth date, address, surname, first name etc," he said. "So if we deal with a computer, an IP address, which is showing special behaviour in terms of the transactions we can follow, then in a reasonable world that is individuals. Computers do not do this alone, this is individuals using this."

"It is a mistake to assume that under these circumstances the data protection rules do not apply," he said.

A court in Munich last month provisionally ruled that IP addresses could only be personal data when they were tied to named, identified individuals.

Hustinx disagreed, saying that identification did not need to be the same as naming.

"If you go to the details of the decision you see that the criteria applied were confused," he said. "They say that the information does not allow someone to be identified. Well, identification does not need to happen on the basis of one IP address only. Does it relate to someone who is identifiable either to the controller or to someone else, using reasonable standards?"

Hustinx also said that he had doubts about the degree to which data which companies claim has been rendered anonymous is truly stripped of all identifiable information.

"I think there are ways to do this in an acceptable manner so I am willing to accept methodologies to anonymise, but my experience is that there is a huge grey zone and many companies are interpreting this in a way that is favourable to them and are underestimating the scope of the law," he said.

Copyright © 2008, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
The 'fun-nification' of computer education – good idea?
Compulsory code schools, luvvies love it, but what about Maths and Physics?
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.