Are IP addresses personal data? It's a question I'm so frequently asked that I thought I'd pause for a moment to reflect on how the scope of "personal data" has changed since the EU Data Protection Directive's adoption in 1995.
The Directive itself defines personal data as "any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity".
That's not the beginning and the end of the story though. Over the years, various regulatory guidance has been published that has further shaped what we understand by the term "personal data". This guidance has taken the form of papers published by the Article 29 Working Party (most notably Opinion 4/2007 on the Concept of Personal Data) and by national regulators like the UK's Information Commissioner's Office (see here). Then throw in various case law that has touched on this issue, like the Durant case in the UK and the European Court of Justice rulings in Bodil Lindqvist (Case C-101/01) and the Google Right to Be Forgotten case (C-131/12), and it's apparent that an awful lot of time has been spent thinking about this issue by an awful lot of very clever people.
The danger, though, is that the debate over what is and isn't personal data can often get so weighted down in academic posturing, that the practical realities of managing data often get overlooked. When I'm asked whether or not data is personal, it's typically a loaded question: the enquirer wants to know whether the data in question can be retained indefinitely, or whether it can be withheld from disclosures made in response to a subject access request, or whether it can be transferred internationally without restriction. If the data's not personal, then the answer is: yes, yes and yes. If it is personal, then the enquirer needs to start thinking about how to put in place appropriate compliance measures for managing that data.
There are, of course, data types that are so obviously personal that it would be churlish to pretend otherwise: no one could claim that a name, address or telephone number isn't personal. But what should you do when confronted with something like an IP address, a global user ID, or a cookie string? Are these data types "personal"? If you're a business trying to operationalise a privacy compliance program, an answer of "maybe" just doesn't cut it. Nor does an answer of "err on the side of caution and treat it as personal anyway", as this can lead to substantial engineering and compliance costs in pursuit of a vague - and possibly even unwarranted - benefit.
So what should you do? Legal purists might start exploring whether these data types "relate" to an "identified or identifiable person", as per the Directive. They might note that the Directive mentions "direct or indirect" identification, including by means of an "identification number" (an obvious hook for arguing an IP address is personal data). They might explore the content, purpose or result of the data processing, as proposed by the Article 29 Working Party, or point out that these data types "enable data subjects to be 'singled out', even if their real names are not known." Or they might even argue the (by now slightly fatigued) argument that these data types relate to a device, not to a person - an argument that may once have worked in a world where a single computer was shared by a family of four, but that now looks increasingly weak in a world where your average consumer owns multiple devices, each with multiple unique IDs.
There is an alternative, simpler test though: ask yourself why this data is processed in the first place and what the underlying individuals would therefore expect as a consequence. For example: Is it collected just to prevent online fraud or is it instead being put to use for targeting purposes? Depending on your answer, would individuals therefore expect to receive a bunch of cookie strings in response to a subject access request? How would they feel about you retaining their IP address indefinitely if it was held separately from other personal identifiers?
The answers to these questions will of course vary depending on the nature of the business you run - it's difficult to imagine a Not For Profit realistically being expected to disclose IP addresses contained in web server logs in response to a subject access request, but perhaps not a huge stretch, say, for a targeted ad platform. The point is simply that trying to apply black and white boundaries to what is, and isn't, personal will, in most cases, prove an unhelpful exercise and be wholly devoid of context. That's why Privacy Impact Assessment are so important as a tool to assess these issues and proposed measured, proportionate responses to them.
The debate over the scope of personal data is far from over, particularly as new technologies come online and regulators and courts continue to publish decisions about what they consider to be personal. But, faced with practical compliance challenges about how to handle data in a day-to-day context, it's worth stepping back from legal and regulatory guidance alone. Of course, I wouldn't for a second advocate making serious compliance decisions in the absence of legal advice; it's simply that decisions based on legal merit alone risk not giving due consideration to data subject trust.
And what is data protection about, if not about trust?
Are IP addresses personal data? It's a question I'm so frequently asked that I thought I'd pause for a moment to reflect on how the scope of "personal data" has changed since the EU Data Protection