YouTube’s indecent exposure
WE ALL ASSUME THAT the Internet sites we visit are our own business. However, recent legal developments in the United States could result in your personal forays becoming – well – not so personal. A recent legal wrangle between online video site YouTube and US broadcaster Viacom has highlighted the troubled waters that Internet users brave when they make use of online services.
Earlier this month a judge in the US ruled that YouTube had to hand over detailed logs of all the usage of its services, including user names and, more importantly, the IP addresses of users that had both uploaded or downloaded videos from its site. Viacom is suing YouTube, which is owned by search giant Google, alleging that it encouraged users to share copyrighted materials owned by Viacom channels – such as Comedy Central, Nickelodeon and MTV – and didn’t do enough to prevent that infringement happening. Viacom is looking for US$1bn in damages from YouTube.
The logs YouTube had been ordered to hand over initially included user names (the names people use to log on to the service) as well as the IP address of the computer that accessed the information. Every time a computer accesses a network, it’s given a unique address (an IP address, like a telephone number) that allows the information it’s requested from the Internet to be sent to it.
Arabella Hallawel, analyst at US research house Gartner, says the ruling that the IP address doesn’t constitute personal data is worrying. “Although it’s difficult it is possible to link an IP address to a specific user through their Internet service provider and that’s the reason why they should be protected,” she says.
An agreement between YouTube and Viacom has Viacom consenting to YouTube removing all personally identifiable data – both user names and IP addresses – before handing it over.
However, the precedent set by the ruling that IP addresses aren’t personal information is still cause for concern. Legislation that would give consumers in SA greater protection over their personal data has still not made it out of the starting blocks. In 2006 SA’s Law Reform Commission asked for comment on a discussion document and draft legislation that would put a legal framework in place as to how companies could use personal information (Finweek, 23 March 2006).
However, that legislation has stalled, and Preeta Bhagattjee, director at SA law firm Cliffe Dekker, says that in recent conversations with the Law Reform Commission it was indicated to her that the Commission was still preparing its report to the Justice Department.
Bhagattjee says it isn’t clear why the process has taken so long, especially since formulating the legislation started in 2002 – well ahead of many other countries. But the benefit of that is while SA started off ahead of the pack, delaying the legislation enables Government regulators to benefit from the experience of other countries that have exposed difficulties (such as what constitutes personal information) in creating legislation focused on protecting personal information.
Meanwhile, Internet users can take comfort in the fact that IP addresses could constitute personal data in SA, says Bhagattjee. She says our Electronic Communications & Transactions Act does provide for the protection of personal information. “It defines personal information as any number, symbol or other particular that could be used to identify a person. That was meant to cover things such as ID and passport numbers. But it could be argued it covers IP addresses as well. However, there’s no case law that’s tested it and it’s unlikely there will be much case law forthcoming,” says Bhagattjee.
Looking ahead, she says SA companies are looking towards European regulations – perceived to be the most progressive – rather than the US for guidance in constructing their own privacy policies.
Although Deon Rudman, deputy director general: legislative development at the Department of Justice, told Parliament’s justice portfolio committee in May that “a Protection of Personal Information Bill would be drafted to comply with international standards”, the length of time that South Africans have been waiting for that legislation seems to suggest legal protection of personal information isn’t high on the list of Government’s priorities.
Finweek
Loading ...