Intellectual Property Law

Is an IP Address Personal Information under Hong Kong Privacy Law?

By IBLS Editor

Privacy laws protect personal individuals? identifiable information.  IP (Internet protocol) addresses itself are not considered personal information, although they may lead to other individuals? personal information such as address, telephone number, name and date of birth, among others. Do IP addresses constitute personal information under China privacy law? This article answers this question by presenting a 2007-Hong Kong?s case.  

The IP address and e-mail login information of an Internet account holder does not constitute personal information within the meaning of Hong Kong Personal Data Ordinance (Cap 486).  1 HKC 287 (2007) [hereafter HKC].  In this case, a Mainland China journalist was convicted of a crime of illegally providing state secrets to foreign entities via e-mail and was sentenced to 10 years imprisonment.  Before his criminal conviction, the journalist complained before Hong Kong Privacy Commissioner of Personal Data. The Commissioner concluded that there was not violation of privacy laws. The journalist appealed and the appeal was dismissed. 

The facts showed that the journalist living in PRC used his personal Yahoo.com.cn e-mail account to send secret information overseas.  Yahoo Hong Kong (YHK) provided the journalist IP address and e-mail login information to Mainland China?s authorities. The journalist complained before the Commissioner.  YHK acknowledged having provided the IP address and some e-mail content to the Mainland China?s authorities.  Government authorities used this IP address to locate the journalist? phone number, office address, and convict him in criminal court.  After the journalist?s complain, the Commissioner launched an investigation to determine whether YHK violated Honk Kong?s Personal Data Ordinance (Cap 486) by providing this information to government authorities.  After the investigation, the Commissioner concluded that YHK did not violate privacy laws.  Following is the appeal court?s conclusion in this case.

1. The appeal court held that personal data, according to the Personal Data Ordinance (Cap 486), related to (1) data directly or indirectly related to a living individual; and (2) data from which the individual?s identity can be ascertained.  The appeal court stated that in this particular case, YHK did not disclose journalist?s personal data because the journalist?s IP address and login information did not constitute personal data within the meaning of the privacy law. The court further stated that neither the IP address nor the e-mail login information can identify an individual.  Indeed, the court held, the information provided by YHK only disclosed that an e-mail was sent from a computer located at a specific address to a recipient, and the date and time of that transaction.

2.  Even if the journalist?s IP address and login information is considered personal data under the Personal Data Ordinance, and even if YHK is considered a data user under this law, YHK did not breach the law because the journalist, as user, gave prescribed consent to this disclosure when he accepted the terms of service and privacy policy statement. This privacy statement allowed YHK or Yahoo Inc. located in United States to make disclosures in accordance with legal procedures.

Therefore, according to this Hong Kong case, YHK can provide users? IP address and login information to the government authorities because these are not considered private information and because once users open their accounts they are consenting to such disclosure provided that it is done according to ?legal procedures.?

Full post as published by IBLS Internet Law Blog on July 22, 2009 (boomark / email).