Table of Contents Table of Contents
Previous Page  14 / 192 Next Page
Show Menu
Previous Page 14 / 192 Next Page
Page Background

did not exist in a form in which access to or processing of the data was not practicable.

The employer should therefore comply with the data access request made under the


Consideration of Certain Types of Information

IP Addresses


An IP address is a specific machine address assigned by the Internet Service Provider to

a computer and is therefore unique to a specific computer. In AAB No. 16/2007, the

Commissioner received a complaint relating to the disclosure of an internet subscriber’s

information, including the IP address of the computer that disseminated the information.

The Commissioner expressed the view that an IP address was information about an

inanimate computer (not an individual) and it did not contain information related to an

individual. Further, it was noted that an IP address alone could not reveal the identity of

the computer user, and thus lacked the characteristic of identifying an individual

directly or indirectly. However, in certain circumstances an IP address can constitute

personal data when it is read together with other information, provided that the identity

of an individual can be ascertained. The AAB agreed that the information collected by

the Internet Service Provider in this case (namely, the business address and email

account provided by the subscriber which did not on their own reveal the identity of the

internet subscriber) together with the IP address disclosed did not amount to personal

data of the complainant. It further opined that when an IP address was coupled with

verified personal information such as name, identity card number and address, it would,

indeed, constitute personal data.


In reaching its decision, the AAB had considered the following excerpt from the

judgment in Cinepoly Records Co. Ltd. and others v Hong Kong Broadband Network Ltd.

and others [2006] 1 HKLRD 255:

12. . . . An IP Address itself does not directly reveal the identity of the subscriber. But the ISP

can track the IP address at a specific time or period to the records of their subscribers,

which include names, Hong Kong ID card numbers and addresses.

13. In short, by cross checking the IP address marked at a specific time or period with the ISP’s

records, the identity and address of the subscriber, whose computer has been used to

upload the music files on the Internet by P2P program, including the WinMX software, can

be revealed.

14. Accordingly, with the assistance of the ISPs, the cloak of anonymity can be pierced and

the true identity of the infringers may be revealed.


The AAB concluded that:

Short of CCTV evidence, it would not be reasonably practicable from such information to

ascertain that it was actually the Appellant who used the computer identified by the IP

address to send out the relevant email at the material time. It could have been anyone, as

long as he had access to that computer (or had the necessary password if one was required

at all).