• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies
You are here: Home / Business / IP address as personal information: Canadian and EU positions

By Occasional Contributors | 2 Minutes Read November 4, 2016

IP address as personal information: Canadian and EU positions

IP addressThe October 19, 2016, judgment of the European Court of Justice in the matter brought by Patrick Breyer against the Federal Republic of Germany,[1] (the EU decision) raises the issue of whether an IP address is personal information under the EU Directive 95/46/EC of the European Parliament and provides an interesting comparison with the Canadian perspective.
In the EU decision, Mr. Breyer claimed the Federal Republic of Germany had no right to retain the IP address from the device he used to search for information on various government websites. He contended that his IP address is personal information that the website operator may only keep to facilitate access to the site and not for general purposes such as safeguarding the security of the site or fending off cyber–attacks such as denials of service.
The Court of Justice held that where third parties, such as Internet service providers (ISP), have subscriber information that can be legally accessed by the website operator and used in conjunction with the IP address to identify the visitor, the IP address is personal information. The court seemed to leave open the question of whether the IP address would constitute personal information if the holder of it could not reasonably or legally obtain the other information needed to identify the owner of the address. In so doing, it adopted a “relative” definition of personal information.
The court also held that individual states could not pass legislation that forbids the use of an IP address for any purpose other than facilitating network access and billing.

Canada’s position

The European decision provides an interesting contrast with the view of the Office of the Privacy Commissioner (OPC) of Canada. In a research paper published in May 2013, the OPC revealed that an IP address, combined with other publicly available information, even without any access to the ISP subscriber records, may permit identification of the owner and his or her Web-browsing or other activities. Based on this finding, an IP address may in many circumstances be personal information regardless of whether the ISP subscriber records linking that address with an individual are legally accessible to the organization collecting the IP address.
This conclusion is consistent with an earlier OPC decision in which it held that an organization’s advertising server could not attempt to access the NetBIOS of a visitor’s computer without consent. A NetBIOS is, according to the OPC, “[a] computer’s common or ‘friendly’ name related to its Internet protocol (IP) address.”[2]
A word of caution, however, is appropriate. The OPC’s findings do not mean that consent to the collection of an IP address is always required. There may be a number of legitimate reasons for collecting this information, including those relating to security of the site. These reasons would not necessarily extend, however, to collection and use of IP addresses for advertising purposes without some form of consent.[3]


[1] ECLILEU:C:2016:779.
[2] PIPEDA Case Summary #2001-25, Office of the Privacy Commissioner of Canada
[3] The OPC’s view on when that consent must be opt-in rather than opt-out is discussed in PIPEDA Report of Findings #2015-001.
By: Julie Himo, Norton Rose Fulbright Canada LLP

  • About
  • Latest Posts
Occasional Contributors
In addition to our regular guest bloggers, First Reference Talks blog published by First Reference, provides occasional guest post opportunities from various subject matter experts on the topics of human resources, employment/labour law, internal controls, information technology, not-for-profit, business, privacy, tax, finance and accounting, and accessibility in Canada among others. If you are a subject matter expert and would like to become an occasional blogger, please contact us. If you liked this post, subscribe to First Reference Talks blog to get regular updates.
Latest posts by Occasional Contributors (see all)
  • Corporations Canada and new transparency about federal non-profit corporations under the CNCA and new fees for certain documents - December 21, 2022
  • How much should a Canadian registered charity spend on administration? - November 30, 2022
  • Finance proposes changes to disbursement quota for charities and some increased transparency - November 11, 2022

Article by Occasional Contributors / Business, Information Technology, Not for Profit, Privacy / collection of IP addresses, cyber-attacks, employment law, Internet Service Providers, IP address, NetBIOS, personal information, subscriber records, use of IP addresses, website security

Share with a friend or colleague

Get the Latest Posts in your Inbox for Free!

Electronic monitoring

About Occasional Contributors

In addition to our regular guest bloggers, First Reference Talks blog published by First Reference, provides occasional guest post opportunities from various subject matter experts on the topics of human resources, employment/labour law, internal controls, information technology, not-for-profit, business, privacy, tax, finance and accounting, and accessibility in Canada among others. If you are a subject matter expert and would like to become an occasional blogger, please contact us. If you liked this post, subscribe to First Reference Talks blog to get regular updates.

Footer

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2023 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy