Under Australian privacy laws, compliant companies have an obligation to give an individual access to any personal information the company holds about them. Personal information includes any information or opinion about an identified or reasonably identifiable individual. However, whether personal information includes an individual’s Internet Protocol (IP) address is up for debate. This article explores whether an individual’s IP address is personal information.
Where Did It All Start?
In June 2013, Ben Grubb, a Fairfax journalist and Telstra mobile customer, asked Telstra for access to all the personal information that Telstra held about him. Telstra delivered call records, billing information and other metadata, including mobile cell locations, to Mr Grubb.
Mr Grubb argued that he had a right to access his mobile network data because it was personal information. He took the matter to the Privacy Commission, who held that mobile network data was personal information. However, the Administrative Appeals Tribunal (AAT) overturned this decision. The AAT also discussed whether an IP address can be considered personal information under the Privacy Act.
Is an IP Address Personal Information?
The Deputy President stated that an IP address is a kind of information about the means by which data is transmitted over the internet. It is not, in itself, ‘personal information’.
An IP address is linked to a particular mobile device at a specific time. However, it is not necessarily connected to a specific person. Although a device may have only one owner, it is uncertain who uses the device at any given time. Accordingly, a device’s IP address may change because it does not have the same IP address for its whole life.
The Australian Law Reform Commission (ALRC) also considered this issue when reviewing the definition of personal information (Discussion Paper 72, Review of Australian Privacy Law). The ALRC suggested that simple contact information, such as a street or postal address, a telephone number, or an IP address, does not (and should not) fall within the proposed definition of ‘personal information’.
Continue reading this article below the formThe Australian Communications and Media Authority
The Australian Communications and Media Authority (ACMA) has also considered whether an IP address should be personal information. The ACMA noted that while IP addresses uniquely identify computers connected to the internet, the address relates to a computer or other device. It is not linked to an individual and cannot alone identify the individual who is using the machine.
ACMA and other commentators note that we cannot determine an individual user’s identity from an IP address alone. However, it is possible to ascertain someone’s identity with a reasonably high degree of certainty by connecting the IP address with other information the Internet service provider holds. For example, it is possible to collate information about a person’s address, telecommunications package, phone number and IP address. If that person lives alone, this information likely relates to them personally.
What Happens if an IP Address is Considered Personal Information?
If IP addresses are ‘personal information’ under the Privacy Act, then its legal obligations and protections would apply. Accordingly, these obligations would affect the ability of entities to share IP address information with international authorities during criminal investigations and enforcement actions.
If mobile network data or IP addresses are considered to be personal information, the Privacy Act would apply to mobile network data information and IP addresses. If that were the case, a suite of new laws would apply in addition to Australia’s existing telecommunications and information technology regulatory framework.
Organisations collect vast volumes of information and data about individuals to include it in a larger data set for analysis and to make business decisions. For example, information about consumer food shopping is relevant to many retail business decisions, including product placement, packaging and pricing. This information is de-identified to remove any personal information.
Businesses that collect and store IP address information are not, by law, required to collate, save and use it according to the Privacy Act requirements. The exemption of IP addresses from the definition of personal information also means that businesses do not need to answer requests for access to information from consumers.
Future Steps
The current definition of personal information in the Privacy Act is information that is “about an individual”. Other countries and Australian regulators are increasingly aware of both:
- widespread collection of information online and in the telecommunications industry; and
- the ability to determine, with reasonable certainty, which person the information relates to.
The Office of the Privacy Commissioner, the ALRC and other industry bodies recognise that the scope of the definition of “personal information” is changing. The ALRC suggests that we need guidance on how the definition applies in different contexts, including information technology and telecommunications industries.
Key Takeaways
The Privacy Act does not necessarily capture an IP address as it is not personal information. However, this definition is not concrete, and the scope of personal information may change in the future.
If you are an APP entity, you must comply with various legal obligations. A privacy policy can assist your customers in understanding what your business does when collecting their personal information. You should also ensure your employees or team members comply with your privacy policy.
If you need help with your obligations under Australian privacy laws, our experienced privacy lawyers can assist as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 1300 544 755 or visit our membership page.
Frequently Asked Questions
An IP address is a unique number given to a device (like a computer or a smartphone) on the internet. This number helps the internet know where to send information.
Personal information is any information or opinion which identifies a person or makes them reasonably identifiable.
We appreciate your feedback – your submission has been successfully received.
