Europe: Your I.P. Address Is Personal
By Saul Hansell at January 22, 2008, 3:31 pm
—————————–
At a hearing Monday, a top privacy regulator in Europe said something that needs to be said: I.P. addresses need to be treated as personal information.

I.P. or Internet Protocol addresses are sort of like phone numbers. They identify two different computers that are exchanging information over the Internet. The analogy is imperfect because Internet service providers often switch I.P. addresses around for home users. So knowing an I.P. address doesn’t guarantee you know what computer is at that address right now.

Nonetheless, Peter Scharr, Germany’s data protection commissioner, told a hearing of the European Parliament that I.P. addresses should generally be seen as personal information, according to a report by The Associated Press. Under some laws, and much industry practice, information that can identify an individual is often subjected to tougher standards for how it can be recorded, stored and transmitted than information about anonymous users and groups of users.

Mr. Scharr is the head of a group of European privacy regulators who are preparing a report on how Internet search engines, including Google, Yahoo and Microsoft, comply with Europe’s privacy laws, which are generally much tougher than those in the United States. The issue also relates to Google’s proposed acquisition of DoubleClick, which is still being reviewed by European regulators.

Most search engines keep log files that record every search and include the I.P. address of the computer conducting the search. Google recently said it would start to erase some of the digits in the I.P. numbers held in its files after 18 months.
Google and other companies maintain that I.P. addresses are not personally identifiable information. One part of the argument is that I.P. addresses identify a computer, not the person using it. True. But that’s the same as a telephone; just because a call was made from a number doesn’t tell you exactly who was talking. Nonetheless, I suspect that most people believe their phone number is quite personal.
The other part of the argument has to do with dynamic I.P. addresses, the practice by Internet providers of switching the I.P. address of home users. Even there, I.P. addresses are not as anonymous as they would appear. Internet service providers keep records of what I.P. addresses are assigned to which customers at what times. Combine these I.S.P. records with a log file from a Web site, and you have a map to who has done what on the Internet.

These two sets of records are not typically combined, but law-enforcement officials routinely subpoena them to try to track down criminals who used the Internet. And they sometimes are used as evidence in civil cases.
I’m not saying that I.P. addresses shouldn’t be collected. There are lots of good reasons for Web sites to keep track of their users (and lots of bad ones too). And sites track users in other ways, like with cookies and site logons.
But I do think it is simply too glib for Internet companies to claim they don’t record personal information when they do keep I.P. addresses.
Privacy is an ever more elusive commodity these days. And the minimum standard for any company, online or off, is to tell customers in crystal-clear language what information it collects, what it does with the information and what choices users have if they don’t want that information revealed.

———————————————————-
Source: The New York Times
Edition:Thursday, January 25, 2007