IP addresses and PII

I don't normally cheer for Google when I don't have shares in the company, but this time I will make an exception.

Alma Whitten, Software Engineer at Google, today posted to their Public Policy Blog that IP addresses shouldn't be considered Personally Identifiable Information (PII).  This is not a problem in the United States but it is in the EU, and if the EU actually were to legislate this it would most definitely affect Microsoft and Google's business functionality in the EU.

Whereas Google has an interest in collecting IP addresses in terms of going geographical search targeting and marketing, for spam filtering purposes this affects us greatly.  Can we collect and record IP addresses for data mining purposes?  Part of fighting spam is knowing who the people are behind the spam storm.  If the EU restricted what we could do with IP addresses, we wouldn't be able to mine through our data in order to look for patterns of spamminess.  The ruling would be that we could potentially use IP information to identify a specific person, which is a no-no, according to the EU.

I would think that blacklist operators like Spamhaus could be impacted by this as well.  They publish a blacklist of known spam operators and they quite deliberately go to the trouble of identifying IPs to individuals.  I could see how a spammer could mount a legal challenge to have themselves removed from Spamhaus.  Of course, I am not a lawyer but lawsuits can drain the life out of you.

I come down on the side of IP addresses not being PII.  I was a little surprised that this was coming from Germany; I would have thought a law this bad would have originated from the French.

You may want to check out the original article, it's a good read.