3 ms·

The ICO does not consider IP addresses personal data since more than one person could use a computer in a household.

by geocar 8y ago

evfanknitram 8y ago
That seems like a weak argument though. Two humans can also have same name and zipcode. They can also have same personal number and bank account number if they are in different countries. Without tracking and correlation, most information on its own is useless.
- geocar 8y ago
  Yes. That's The ICO's position: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe...
- bostik 8y ago
  This reads like you are intentionally trying to misunderstand. GDPR has two categories of user information: direct identifiers and indirect identifiers. Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort. Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted: - The tuple (bank account number, country) is enough to target an individual. - The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß] Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect. Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers. ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.
  - evfanknitram 8y ago
    I have no idea what you mean. I was not talking about GDPR.
switch007 8y ago
Currently, or in relation to GDPR? What's your source? https://ico.org.uk/media/for-organisations/data-protection-reform/overview-of-the-gdpr-1-13.pdf https://ico.org.uk/media/for-organisations/data-protection-r... (20th Oct 2017): > Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data
- geocar 8y ago
  > What's your source? The ICO. I've called them up, and they've confirmed their 2011 interpretation of personal data: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe... An IP address is "personal data" in the same way that "lifestyle information" or a "location" is. That someone can combine an IP address with other information to personally identify someone is important, but it doesn't prevent me from logging personal data.
DanBC 8y ago
That's their position at the moment. GDPR makes it a bit more explicit: if you can combine the IP address with other information to identify a natural person it becomes personal data.
- geocar 8y ago
  Sure, but by itself, an IP address isn't personal data.
ealexhudson 8y ago
That's not true; I can only assume you're reading the 2011-era DPA guidance. Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/documentation/how-do-we-document-our-processing-activities/ https://ico.org.uk/for-organisations/guide-to-the-general-da... As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.
- geocar 8y ago
  Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1]) [1]: https://news.ycombinator.com/item?id=17060280 https://news.ycombinator.com/item?id=17060280 The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.
  - ealexhudson 8y ago
    Jurisprudence in this area disagrees with you: "online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user" http://curia.europa.eu/juris/document/document.jsf?text=&docid=186346&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=53422 http://curia.europa.eu/juris/document/document.jsf?text=&doc... This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data). So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig. I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example). I understand that's not the outcome you're looking for.

The ICO does not consider IP addresses personal data since more than one person could use a computer in a household.

by geocar 8y ago

The ICO does not consider IP addresses personal data since more than one person could use a computer in a household.

That seems like a weak argument though. Two humans can also have same name and zipcode. They can also have same personal number and bank account number if they are in different countries. Without tracking and correlation, most information on its own is useless.

geocar 8y ago
Yes. That's The ICO's position: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe...
bostik 8y ago
This reads like you are intentionally trying to misunderstand. GDPR has two categories of user information: direct identifiers and indirect identifiers. Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort. Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted: - The tuple (bank account number, country) is enough to target an individual. - The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß] Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect. Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers. ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.
- evfanknitram 8y ago
  I have no idea what you mean. I was not talking about GDPR.

switch007 8y ago

Currently, or in relation to GDPR? What's your source? https://ico.org.uk/media/for-organisations/data-protection-reform/overview-of-the-gdpr-1-13.pdf https://ico.org.uk/media/for-organisations/data-protection-r... (20th Oct 2017): > Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data

geocar 8y ago
> What's your source? The ICO. I've called them up, and they've confirmed their 2011 interpretation of personal data: https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf https://ico.org.uk/media/for-organisations/documents/1591/pe... An IP address is "personal data" in the same way that "lifestyle information" or a "location" is. That someone can combine an IP address with other information to personally identify someone is important, but it doesn't prevent me from logging personal data.

DanBC 8y ago

That's their position at the moment. GDPR makes it a bit more explicit: if you can combine the IP address with other information to identify a natural person it becomes personal data.

geocar 8y ago
Sure, but by itself, an IP address isn't personal data.

ealexhudson 8y ago

That's not true; I can only assume you're reading the 2011-era DPA guidance. Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/documentation/how-do-we-document-our-processing-activities/ https://ico.org.uk/for-organisations/guide-to-the-general-da... As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.

geocar 8y ago
Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1]) [1]: https://news.ycombinator.com/item?id=17060280 https://news.ycombinator.com/item?id=17060280 The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.
- ealexhudson 8y ago
  Jurisprudence in this area disagrees with you: "online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user" http://curia.europa.eu/juris/document/document.jsf?text=&docid=186346&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=53422 http://curia.europa.eu/juris/document/document.jsf?text=&doc... This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data). So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig. I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example). I understand that's not the outcome you're looking for.