IP addresses and personal information (was Re: [LINK] Fwd: On Line Opinion - 16 February 2007)

[Irene Graham]

On Thu, 22 Feb 2007 16:11:47 +1100, Howard Lowndes wrote:
> On Thu, 22 Feb 2007 15:52:38 +1100, Marghanita da Cruz wrote:
>> The talk I went to by Hitwise was pretty compelling see
>> <http://www.hitwise.com.au/products-services/how-we-do-it.php>
>>
>
> Tell me where this doesn't breach either or both of the Privacy Act and
> the Telecommunications Act:

EFA would like to know that as well. 

> "The network-centric methodology employed by Hitwise enables the most
> efficient way of monitoring of how more people visit more websites than
> any other way of measuring Internet usage.
>
> Hitwise has developed proprietary software that Internet Service
> Providers (ISPs) use to analyze website usage logs created on their
> network. The anonymous data sent to Hitwise from the ISPs include a
> range of industry standard metrics relating to the viewing of websites
> including page requests, visits and average visit length."

EFA raised the Hitwise issue in a submission to the Senate Legal and 
Constitutional References Committee's Inquiry into the Privacy Act 1988:
Sect 4.3(a) Businesses covertly surveilling Internet users
http://www.efa.org.au/Publish/efasubm-slcrc-privact2004.html#52_9
or
http://www.aph.gov.au/senate/committee/legcon_ctte/privacy/submissions/sub1
7.pdf

The Committee subsequently invited Hitwise to lodge a submission which they 
did:
http://www.aph.gov.au/senate/committee/legcon_ctte/privacy/submissions/sub4
7.pdf

According to that submission, apparently Hitwise holds the opinion that IP 
addresses are not personal information (and I gather that they therefore 
consider disclosure, collection and use of IP addresses without consent of 
individuals does not breach any law.).

The Hitwise submission stated:

	"IP addresses are not considered to be 'personal information' as they do 
not identify a person. However, EFA appears to be claiming that an IP 
address can be said to identify 'some individuals' and that it should be 
regarded as 'personal information'. It is not clear why EFA has formed this 
view."

EFA then lodged a supplementary submission to Committee explaining in 
detail why EFA has the view that IP addresses are personal information (in 
part because that is precisely what law enforcement agencies use to 
find/identify individuals):

http://www.efa.org.au/Publish/efasubm-slcrc-privact2005-suppl.html
or
http://www.aph.gov.au/senate/committee/legcon_ctte/privacy/submissions/sub1
7a.pdf

The principal result of that Committee inquiry was a recommendation that 
the ALRC or some such other body conduct a more comprehensive review of 
privacy laws. The ALRC is currently doing that and EFA has been advised 
that all submissions sent to the Senate Committee are being reviewed as 
part of the ALRC review.

Regards
Irene

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Irene Graham
Executive Director - Electronic Frontiers Australia Inc. (EFA)
Web: <http://www.efa.org.au>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~