To many, “personally identifiable information” (also “PII” or “personal information”) means information that can be used to identify an individual, such as\u00a0a person’s name, address, email address, social security number\/drivers’ license number, etc.\u00a0However, in the US, there is no uniform definition of personal information. This is because the US takes a “sectoral” approach to data privacy.\u00a0In the US, data privacy is governed by\u00a0laws, rules and regulations specific to market sectors such as banking, healthcare, payment processing, and the like, as well as state laws such as breach notification statutes).\u00a0Companies,\u00a0such as Google, often include their own definition of personal information\u00a0in their\u00a0privacy policy. Even though there is no uniform definition, however, it’s clear that that more and more information is falling under the PII\/personal information umbrella.<\/p>\n
One category of data with potentially significant implications to US businesses if classified as PII are Internet Protocol (IP) and Media Access Control (MAC) addresses.<\/p>\n
Canada’s approach<\/em>. In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) defines “personal information” as “information about an identifiable individual.”\u00a0The Office of the Privacy Commissioner of Canada (OPCC) has released an interpretation<\/a>\u00a0making clear that this definition must be given a “broad and expansive interpretation,” and that it includes information that “relates to or concerns” a data subject.\u00a0With respect to IP addresses, according to the OPCC\u00a0an Internet Protocol (IP) address is\u00a0personal information\u00a0if it can be associated with an identifiable individual.\u00a0(Note that in Canada, business contact information is not considered personal information, which implies that an IP or MAC address of a work computing device associated with an employee’s work contact information is not personal information.)<\/p>\n The European approach.\u00a0<\/em>In Europe, the current Data Protection Directive and the proposed Data Protection Regulation both define\u00a0personal data\u00a0<\/a>as “any information relating to an identified or identifiable natural person.” Individual EU member states differ on whether an IP address should be considered personal data. The European Court of Justice (ECJ) has held<\/a> that IP addresses are protected personal information “because they allow … users to be precisely identified,” and is considering whether to adopt an even stronger position that dynamic IP addresses collected by a website operator are personal information even if though the Internet service provider, and not the website operator, has the data needed to\u00a0identify the data subject.\u00a0The same rules should apply to MAC addresses.\u00a0The new Data Protection Regulation, which will override member state implementations of the Directive, states in its findings that “[n]atural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.”<\/p>\n In the US, the sectoral and state-by-state approach to data privacy does not paint a clear picture\u00a0as\u00a0to whether\u00a0an IP address or MAC address should be considered\u00a0personal information.<\/p>\n Given all this, what should US businesses do?<\/p>\n To many, “personally identifiable information” (also “PII” or “personal information”) means information that can be used to identify an individual, such as\u00a0a person’s name, address, email address, social security number\/drivers’ license number, etc.\u00a0However, in the US, there is no uniform … Continue reading \n
\n
\n<\/em>If linkable information is, or reasonably\u00a0can be, associated\u00a0or linked with an identifiable individual in your records, it becomes personal information.
\n<\/strong><\/li>\n