Feeds

Anonymous web data can be personal data, claims expert

Own it by owning up

Boost IT visibility and business value

A data protection specialist claims that users can gain control of their browsing history and have it protected by the UK’s Data Protection Act just by contacting companies such as Google, Yahoo! and Microsoft and telling them their identities.

There is debate in privacy circles about when identifying information such as a computer user's internet protocol (IP) address counts as 'personal data'. Information which does count as personal data qualifies for legal protection under the Data Protection Act.

Companies and privacy regulators are agreed that IP addresses can be, and indeed often are, 'personal data' as defined in the UK law and the EU Directive on which it is based. But most observers stop short of saying that an IP address is always 'personal data'.

Now data protection specialist Dr Chris Pounder of Amberhawk Training has said that there is a way in which internet users can force companies to consider information held about them as 'personal data'.

"There is a current, lively debate as to whether data that contains no name but is linked to an internet user session via an IP address, URL or similar reference number is personal data or not," said Pounder. "If the individual user concerned provides the service provider (e.g. Google) with the necessary identifying information (easily obtainable as we show), then the data are personal data, unambiguously in relation to any future processing."

"In other words, any individual users can, at any time, seek the protection of a data protection regime by providing the necessary identifying details to any organisation that stores their IP address or URL," he said.

Pounder outlined his view that by connecting a person's actual identity with the IP address or other information stored in a company's systems, that person can ensure that all the information connected to that record must be classed as 'personal data'.

"The stakes are high: if the data are not personal data, then the person who controls the data has almost untrammelled power to decide the nature of the processing," he said. "By contrast, if the data are personal data, that controller would be constrained by the data protection obligations that serve to protect the privacy of the individual user concerned."

Pounder said that the practice, if widespread, could have implications for how companies that hold a lot of data about users treat that data.

"Service providers are processing personal data if they have data in their possession that relates the use of a service to an identified living user of that service. In such circumstances data protection legislation would apply," said the paper that Pounder has published. "This position is self evident from the definition of personal data."

"Service providers will also be processing personal data if they can anticipate that the information that identifies a living individual is likely to come into their possession (e.g. if staff are likely to look up details about an individual user from any source, or to obtain identifying information from a third party)," said the paper.

Pounder said that this means that if enough people send their personal details and their identifying IP addresses or URLs to a data controller, they will have to assume that everyone in their databases is identified.

"If sufficient individual users each provide the necessary identifying details, then all the data linked to any individual should be considered to be personal data".

Pounder said that where it is likely that individuals will provide such details the implications for service providers are clear. They should, he said, treat all identifying information as personal data.

"Data containing IP data, cookie related data or a Street View URL etc should be treated as personal data if individuals, if at any time, can provide the necessary identifying details in a complaint," said the Amberhawk report. "The more controversial the service, the more complaints will be generated, the more data will be transformed into personal data."

"That is why a prudent service provider could conclude that, depending on the nature of the service, they need consider treat data as if they were personal data at the outset and without the need for any individual to send a complaint," it said.

See: The report (26-page/288kb pdf)

Amberhawk blog

OUT-LAW Guide to IP addresses and the Data Protection Act

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

The Essential Guide to IT Transformation

More from The Register

next story
Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
'Greenhouse effect is real, but as for the rest of it ...'
Adam Afriyie MP: Smart meters are NOT so smart
Mega-costly gas 'n' 'leccy totting-up tech not worth it - Tory MP
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
Apple smacked with privacy sueball over Location Services
Class action launched on behalf of 100 million iPhone owners
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.