***TEACH*** - Is your IP Address Personal Information? Article by Mark Vincent and Brett Winterford - This is an excerpt. Digital Identifiers One of the main questions for the digital world to consider is whether an IP address or device identifier (such as a MAC address) could be considered PII. An IP address, in many senses, is an identifier for an individual that can also be tied to both a physical address and the use of a variety of online services. A MAC address would be even more specific. A mobile phone number — one attendee noted — is an identifier that rarely changes over time. Is it PII? Arguably, [PII] could be a car license plate or an IP address — data which you might not think can reveal the identity of an individual, Vincent noted. If you can combine that with another data set relatively easily, than it can be considered personally identifiable information. One attendee at our roundtable — an Information Security Manager in the healthcare sector —said that the Office of the Information Commissioner needs to provide clarity on whether these digital footprints constitute information that needs to be handled sensitively under the Act. Its hard to draw the line on what is PII. If an IP addresses is a static address and you can identify the end user, it could be argued that it is. It would be helpful if the commissioner were more specific on this matter — he should come out and say: These are the items that could be used to identify an individual. Its also important for those developing online services to consider how our definition of PII might sit with definitions elsewhere in the world. The services we acquire from multinational providers tend to have been developed without our definition of PII in mind. When cloud computing providers or social networks went looking for a compliance policy, they most often took a US-centric position. In Europe, the assumption is that if you can match this number with an individual, the data fits the bill. But other jurisdictions might argue that a number designed to identify a machine doesnt identify a human. The closest we have to ascertaining the OAICs opinion in this regard is in a September 2013 paper advising mobile app developers on how they should approach privacy issues under the existing Act. Personal Information could include Internet Protocol (IP) addresses, Unique Device Identifiers (UDIDs) and other unique identifiers in specific circumstances, the paper advised. This week weve asked the OAIC whether this still is still the case under the Amendments, and what specific circumstances might apply. #MarieBrigitteSouci HBOS Executive Admin Technical Secretary.
Posted on: Sun, 09 Mar 2014 00:09:24 +0000
Trending Topics
Recently Viewed Topics
© 2015