[102032] in North American Network Operators' Group
Re: EU Official: IP Is Personal
daemon@ATHENA.MIT.EDU (Eric Brunner-Williams)
Wed Jan 23 15:11:51 2008
Date: Wed, 23 Jan 2008 11:53:52 -0800
From: Eric Brunner-Williams <brunner@nic-naa.net>
To: Paul Vixie <vixie@isc.org>
CC: nanog@merit.edu
In-Reply-To: <g3wsq0bgi6.fsf@sa.vix.com>
Errors-To: owner-nanog@merit.edu
Paul Vixie wrote:
> hank@efes.iucc.ac.il (Hank Nussbacher) writes:
>
>
>> http://ap.google.com/article/ALeqM5g08qkYTaNhLlscXKMnS3V8dkc-WwD8UAGH900
>>
>
> they say it's personally identifiable information, not personal property.
> EU's concern is the privacy implications of data that google and others
> are saving, they are not making a statement related to address ownership.
>
Correct. In the EU DP framework (see:
http://ec.europa.eu/justice_home/fsj/privacy/), personal
privacy doesn't arise from private law (contract or property), but from
public law (the human rights
statements contained in the treaty under which the EU is formed).
However, Google/DoubleClick claim they have the right to collect PII
data and disclose less than
their complete data collection policy, and in particular, claim that
endpoint identifiers do not tend
to identify individuals. Further, they assert a property claim on such
collected data.
See the partialip definition in the W3C's P3P Spec for an attempt to
straddle the fence at offset 7:
"a partialip element represents an IP version 4 address (only - not a
version 6 address) which has
had at least the last 7 bits of information removed"
The theory for partialip was that a full address (v4 or v6) was PII, and
a partial (for v4 only, at 7bits)
was not PII.
Eric
P. S. How many bits in the mask are necessary to achieve the non-PII aim?
