Anybody running pcap traces?

[Nick Hilliard]

On 01/06/2011 13:25, Nick Hilliard wrote:
> It's a difficult area. On the one hand, there is a EU working group opinion
> (I don't have the reference for this right now) to the effect that the
> combination of IP addresses and timestamps unquestionably constitutes
> personally identifiable information as defined in the data protection
> directives. While this interpretation is not legally binding in any way,
> it's the sort of thing that would be given very serious consideration by a
> court of law.

Just for the record, the reference for this is here:

http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2000/wp37en.pdf

Chapter 3 part I, paragraph "Personal data on the Internet" states:

"The possibility exists in many cases, however, of linking the user’s IP 
address to other personal data (which is publicly available or not) that 
identify him/her, especially if use is made of invisible processing means 
to collect additional data on the user (for instance, using cookies 
containing a unique identifier) or modern data mining systems linked to 
large databases containing personally-identifiable data on Internet users.
Therefore, even if it might not be possible to identify a user in all cases 
and by all Internet actors from the data processed on the Internet, this 
paper works on the basis that that the possibility of identifying the 
Internet user exists in many cases and that large masses of personal data 
to which the data protection directives apply are therefore processed on 
the Internet."

Nick