There is an interesting tug of war brewing between Google and the European Commission’s data protection working party, also known as the Article 29 WP.
Google has long held that IP addresses do not count as personally identifiable information, mostly because IP addresses for most peoples’ personal computers are shifted around based on need, much the way servers are pointed at different tasks based on processing power need.
This fluidity has given Google the convenient leeway to make the argument that IP addresses aren’t really attached to our PCs. The Article 29 WP respectfully disagrees and is working on a working paper, due in April, that dissects the way search engines store data, and presumably affect privacy.
“Search engines fall under the EU Data Protection Directive 95/46/EC if there are controllers collecting users’ IP addresses or search history information, and therefore have to comply with relevant provisions,” the party wrote in a statement last week, noting that these provisions also apply to Internet search engines based outside Europe.
Basically, the WP wants to establish that users must consent to their data being collected and that search engines must be held accountable to these rules.
Google, which relies on IP addresses to collect information on users to gauge search patterns and better target users with online ads, objects. Normally, Google Global Privacy Counsel Peter Fleischer argues against the EC’s logic, but this time Google used a software engineer to convince us that IP addresses are not personal.
Google’s Alma Whitten wrote: “The IP addresses recorded by every Web site on the planet without additional information should not be considered personal data, because these Web sites usually cannot identify the human beings behind these number strings.”
True, but what most people are objecting to is that these addresses in Google’s hands combined with those from an Internet service provider, can link a particular computer to a particular pattern of searches, telling us more information about people. IP addresses, while they can’t point the finger at a specific person, can narrow things down to potentially identify users.
This is an argument of black-versus-white versus the proverbial gray area: The EC unequivocally views the IP address as personal data. Google says that you can’t really tell a computer user by a shifting IP address.
Most people, if they don’t agree with the EC outright, at least dislike Google for trying to downplay the issue.
The question I have: why is Whitten responding to something that is in Fleischer’s domain? Well, it could be that Fleischer is getting browbeaten by Europe and all of the bloggers for making the same argument about IP addresses not being personal. People, it seems, are tired of hearing from him.
The issue takes me back to late last year, when Google called me out of the blue to talk to Fleischer. There was no news; he just wanted to set the record straight because there was a lot of misunderstanding and confusion, particularly in light of the DoubleClick bid.
Increasingly, as I read these reports that basically skewer Fleischer’s credibility, I can’t help but think he was looking for an ally. No matter. Fleischer isn’t the one who needs the ally.
Where the EC is concerned, Google needs to get a major partner in IP address advocacy, or agree with the organization’s provisions.