News
Privacy in the online world
First published in the Dominion Post, 28 January 2008.
Debate has been ignited over what exactly constitutes personal information amid growing concern about online privacy. Heidi Leslie looks at the European debate and why it triggers a reminder for New Zealand business.
Privacy in the online world is taking another interesting twist in Europe, fuelled by a call for internet protocol (IP) addresses to become protected information.
But in New Zealand our privacy laws may already afford the protection should a potential breach be questioned.
Each computer is assigned an IP address – a series of specific numbers that can be used to identify it and its user. During hearings into online data protection in the European Parliament last week, came a call from the head of the European Union’s privacy regulators for IP addresses to be protected as if they were sensitive personal information.
This statement has caused a stir, particularly among search engines such as Yahoo and Google, who typically collect IP addresses to help refine search results – and localise or personalise its online advertisements.
While clearly not everyone believes that IP addresses are personal information, it is a view that is consistent with the spirit of privacy laws around the world: information that can be used to identify individuals should be protected.
Under the New Zealand Privacy Act, “personal information” means information about an identifiable individual. Given that an IP address is unique code assigned to a particular computer and identifiable individuals can then be linked to their computer, it is prudent to treat those IP addresses as personal information for the purposes of the Privacy Act.
Companies and individuals that collect IP addresses should be aware that the obligations of the Privacy Act may apply to IP addresses, just as they do to individuals’ names, addresses, phone numbers and other personal details. They ought to comply with the requirements of the Privacy Act when it comes to collecting, storing, protecting and sharing IP addresses or may find themselves on shaking ground in the event of a breach.
In the meantime in Europe the debate continues, with the search engines and other internet organisations touting the possibility of a self-regulation framework rather than face new laws with potential to have a major impact on online advertising and the search engine business.
