[Infowarrior] - I.P. Address: Partially Personal Information

[Richard Forno]

 February 24, 2008,  2:12 pm
I.P. Address: Partially Personal Information

By Saul Hansell

http://bits.blogs.nytimes.com/2008/02/24/ip-address-partially-personal-infor
mation/index.html

My post about whether Google¹s records of the Internet Protocol address
should be considered personal information under privacy law, brought two
comments from Googlers: Matt Cutts, an engineer, and from Peter Fleischer,
Google¹s global privacy counsel.

Both go over the many technical and legal reasons that the I.P. addresses in
Google¹s records can¹t, in isolation, be tracked back to an individual. Very
true.

But the converse is also true: The I.P. addresses Google collects, when
combined with other information, can sometimes identify an individual, or a
household.

This raises all sorts of implications that need to be considered as we move
into a world where so many more actions we take will be logged digitally in
some way.

The opposite of identification is anonymity. When I.P. addresses of Internet
actions are all recorded, anonymity is harder to preserve.

Logging I.P. addresses is similar to a security camera recording everyone
entering your store. Without any more information, you don¹t know the names
or identities of any of the people on the recording. But that recording
makes it much easier to gather that information and find out who is
shopping. Some people you can identify because they go on to buy something
providing their names. Other people you can¹t identify, but the government
with its database of drivers licenses photographs or other investigative
techniques can.

Mr. Fleischer acknowledges that Google¹s records, combined with those from
an Internet service provider, can indeed link a particular computer to a
particular pattern of searches. He says I.S.P.¹s, by law, can¹t give that
information to Google. But he admits that government investigators or even
private litigators can:

    In order for someone to tie the IP to an account holder, there have to
be at least two subpoenas issued: one to Google and a separate one to the
ISP.

This is important because people have lots of reasons to keep information
private. They may not want Google to use for advertising. But they may also
want to keep secrets from people who may have the right to sue them.

Mr. Fleischer discusses at some length the technicalities of European law
over what defines personal information. I.P. addresses, he argues don¹t
qualify. And more broadly, he suggests that some of the general principles
that apply to personal information‹standards of notice and choice, for
example­ aren¹t always appropriate for I.P. addresses.

Perhaps we should start considering another category: partially personal
information‹bits of data that can be personal under certain circumstances.
There are real questions about who should collect this information, under
what circumstances, and what they should do with it.

The statements by Google and others that simply argue that I.P. addresses
aren¹t personal distract people from the thoughtful understanding of what
they are and how they can be used.