2

I was reading a booklet when I came across the phrase "personally identifiable". What does it mean in the following context (emphasis mine):

As the common household and business router will often display just one IP address for all of the people connected to it, the IP address will identify a group of people rather than just one individual. As a result, it is often hard, if not impossible, to be sure who exactly did what, purely on the basis of an IP address.

On the other hand, IP addresses are very often personally identifiable, and so, following a basic precautionary principle, must be treated as such unless they can definitively proven not to be.

First paragraph says that it's not easy ("often hard, if not impossible") to identify the exact person who did something behind a router shared with others. But "personally identifiable" in the second paragraph seem to say the opposite. I think I'm missing a nuance here.

Update: The booklet can be downloaded from http://www.edri.org/files/2012EDRiPapers/how_the_internet_works.pdf It does not define "personally identifiable".

  • 1
    The IP addresses of those people living alone, and using home computers not connected to LANs? Though I agree, 'often X and very often not X' does seem contradictory. And that's what I agree the article seems to say. – Edwin Ashworth Nov 16 '13 at 16:07
  • So that means "personally identifiable" basically means "the person who did a certain thing can be identified" and I'm just confused because of the contradictory wording. Huh! (I just saw your edit and removed the second part of my comment.) – some user Nov 16 '13 at 16:15
  • 1
    Ah, the term is a set two-word term (actually, one could argue that PII is a three-word term from what follows), as this Wikipedia article tells us: : Personally identifiable information "Personally identifiable information" (PII), as used in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context...." So yes, information that can be used to identify an IP address need not be PII. – Edwin Ashworth Nov 16 '13 at 16:23
  • @EdwinAshworth Could you please write an answer then? I guess it's not that big of a question what "personally identifiable" means, but perhaps it would be good to clarify it just in case. You ninja'd me again by 38 seconds. But I'll keep this comment :) – some user Nov 16 '13 at 16:23
  • 1
    Sorry; I'm only assuming that personally identifiable (information) is being used here in the way Wikipedia says. Even if that's true (as seems likely), I wouldn't want to guess which variant is intended ([the term PII] 'has four common variants based on personal /personally, and identifiable / identifying. Not all are equivalent, and for legal purposes the effective definitions vary'.) PII is thus a (or several!) legal expressions, which makes it off-topic here (and risky for someone to comment on). But I can imagine lawyers arguing heatedly the question "Is this information PII?" – Edwin Ashworth Nov 16 '13 at 16:52
1

The two paragraphs mention two cases that often occur: one where an IP address does not reveal personal identities, and one where it does. The text probably discusses both cases to lessen the likelihood that a reader will assume that either case alone accounts for nearly all situations. Note, the first case is good if one wants to avoid infringing privacy laws while collecting IP numbers, and bad if one is trying to find out who posted something scurrilous; and vice versa for the other case.

Edit note: The following is based on and expands upon the first paragraph of my original answer.

As noted in a comment, the meaning of personally identifiable is related to the concept of personally identifiable information, that is, to information that may be covered by privacy laws and information security concerns.

The booklet mentioned in the question, “How the internet works”, by McNamee, Fiedler, Humeau, and Maisuradze at EDRI.ORG, apparently isn't in aid of specific interest groups such as privacy advocates, data thieves, governments, businesses, etc. The section at issue (Page 5, THE IP‑ADDRESS) neutrally presents general information. It apparently is intended to slightly inform Internet users who don't know what an IP address is. As such it is worded somewhat informally and diffusely but appears to be entirely and technically correct.

Just before the paragraphs quoted in the question, the booklet says “In many cases, IP addresses may be used to identify an organisation or individual that has acquired the services of an Internet Service Provider... the IP address does not always identify the person behind some digitally traceable act”. This context suggests that the phrase personally identifiable as quoted in the question means traceable to an individual.

  • The use of 'often' ('much of the time') and 'very often' for non-overlapping probabilities / frequencies disturbs me. As does the blithe use of an ill-defined technical/legal term. – Edwin Ashworth Nov 16 '13 at 17:01
  • @EdwinAshworth, I see no problem with “often” as used here for multiple cases. I agree that use of “very” is disturbing. Note, we don't know the name, subject, or intent of the booklet the extract is from. The booklet may have previously defined “personally identifiable” and may be using it appropriately; or perhaps not. – James Waldby - jwpat7 Nov 16 '13 at 17:18
  • The booklet can be downloaded from edri.org/files/2012EDRiPapers/how_the_internet_works.pdf It does not define "personally identifiable". – some user Nov 16 '13 at 17:24
  • @canpolat, I edited accordingly – James Waldby - jwpat7 Nov 16 '13 at 18:14
  • It's the twinning of mutually exclusive descriptors: it is often fine but very often raining. However, with esoteric meanings for 'personally identifiable', this problem is removed, leaving the 'what exactly do they mean?' problem. At least OP now knows what the problem is. – Edwin Ashworth Nov 16 '13 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.