Office Templates Cookbook

Spanish Agency of Protection of Data: IP address is personal data

Law 257/2007 of 18 October, retention of data relating to electronic communications and public communications networks, requires providers of Internet access to retain traffic data and billing for a maximum period of twelve months to the general interest of fighting crime and cybercrime. With regard to Internet access, among those retained data set (section 3.2.i) "the Internet Protocol address, whether dynamic or static, allocated by the Internet access provider to a communication, and the user ID or subscriber or registered user. "

The English Agency for Data Protection (AEPD) has ruled in its subsequent reports and statements that the IP addresses (the numerical sequence that identifies the interface of a device connected to the network, eg a computer) are data personal and therefore subject to the rules on data protection of individuals. This is expressed, among other resolutions issued by the AEPD, Report 327/2003, and the Declaration on Internet browsers December 1, 2007.

AEPD This consideration of the concerns the fixed IP addresses, but also the dynamics, since in many cases to identify the user, all against the common interpretation that considers IP addresses are not themselves a personal data to its effective partnership with an individual, the device owner or user of it at the time of connection and / or Data Access Network, contributes to this interpretation, for example, that the fact that corporate internal networks often have a unique IP address for all users too can hinder the identification of the user who access or action. But this should not be a problem when performing this type of identification, since the company can implement appropriate measures and simple to control the use of the Intranet of the organization and Internet access by employees previously informed of these circumstances.

Finally, regarding implementation of appropriate security measures for files containing addresses IP, keep in mind that according to Article 81.4 of the Regulations implementing the Data Protection Act, "the files for which they are responsible operators providing electronic communications services available to the public or operate electronic communications networks with respect to data traffic and location data, shall also apply security measures and middle-level, as high level security contained in Article 103 "of the regulation on access log, which requires, among other requirements, the minimum storage period of the recorded data is two years. Mary

Teresa Nevado

(Posted by Aude, Information Security, http://www.audea.com/ ).

know