14 / 192
did not exist in a form in which access to or processing of the data was not practicable.
The employer should therefore comply with the data access request made under the
Ordinance.
Consideration of Certain Types of Information
IP Addresses
2.32
An IP address is a specific machine address assigned by the Internet Service Provider to
a computer and is therefore unique to a specific computer. In AAB No. 16/2007, the
Commissioner received a complaint relating to the disclosure of an internet subscriber’s
information, including the IP address of the computer that disseminated the information.
The Commissioner expressed the view that an IP address was information about an
inanimate computer (not an individual) and it did not contain information related to an
individual. Further, it was noted that an IP address alone could not reveal the identity of
the computer user, and thus lacked the characteristic of identifying an individual
directly or indirectly. However, in certain circumstances an IP address can constitute
personal data when it is read together with other information, provided that the identity
of an individual can be ascertained. The AAB agreed that the information collected by
the Internet Service Provider in this case (namely, the business address and email
account provided by the subscriber which did not on their own reveal the identity of the
internet subscriber) together with the IP address disclosed did not amount to personal
data of the complainant. It further opined that when an IP address was coupled with
verified personal information such as name, identity card number and address, it would,
indeed, constitute personal data.
2.33
In reaching its decision, the AAB had considered the following excerpt from the
judgment in Cinepoly Records Co. Ltd. and others v Hong Kong Broadband Network Ltd.
and others [2006] 1 HKLRD 255:
12. . . . An IP Address itself does not directly reveal the identity of the subscriber. But the ISP
can track the IP address at a specific time or period to the records of their subscribers,
which include names, Hong Kong ID card numbers and addresses.
13. In short, by cross checking the IP address marked at a specific time or period with the ISP’s
records, the identity and address of the subscriber, whose computer has been used to
upload the music files on the Internet by P2P program, including the WinMX software, can
be revealed.
14. Accordingly, with the assistance of the ISPs, the cloak of anonymity can be pierced and
the true identity of the infringers may be revealed.
2.34
The AAB concluded that:
Short of CCTV evidence, it would not be reasonably practicable from such information to
ascertain that it was actually the Appellant who used the computer identified by the IP
address to send out the relevant email at the material time. It could have been anyone, as
long as he had access to that computer (or had the necessary password if one was required
at all).