The protection of IP addresses under discussion

January 25, 2016

European regulators are debating whether Internet Protocol addresses should be protected as if they were sensitive personal data.

The issue was discussed on Monday at a meeting of the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs. Representatives of Google, Microsoft, Yahoo, and the Internet Advertising Bureau Europe, among others, were present to guard the online advertising business against new, potentially burdensome privacy requirements.

Germany’s data protection commissioner, Peter Scharr, reportedly said that when a person can be identified by an IP address, that information should be treated as personal information. Other European policy groups apparently share this view.

Were IP addresses to be categorised as personal information, Web sites, search engines and advertisers would have to change the way they handle and store IP data in order to comply with more stringent privacy standards.

Ray Everett-Church, director of policy for e-mail reputation company Habeas, observed that US healthcare privacy law already contemplates IP addresses as potentially being part of what might be considered personally identifiable information, in situations where the numbers could be associated with other identifying information.

He said in an e-mail: “While an IP address could be stable enough over time to be linked to an individual in a reliable way, given the prevalence of dynamic IP addresses it’s very much a moving target. It makes sense to consider that an IP address could be personally identifiable when associated with other information – the kind of information in the hands of companies like Google and Microsoft.

“But all by itself, an IP address tells you nothing more personal about somebody than any other random assortment of numbers.”

Google’s chief privacy counsel, Peter Fleischer, spoke at a Monday afternoon panel on search privacy. In the process of reiterating Google’s continued commitment to privacy and defending Google’s acquisition of DoubleClick, he expressed support for the sort of self-regulation favoured by the US Federal Trade Commission and tech industry groups.