Privacy watchdog clears Yahoo

Revealing journalist's IP address did not violate data laws

Yahoo Hong Kong had not violated personal data laws in revealing the computer address of journalist Shi Tao to the mainland authorities - which led to his imprisonment - the city's privacy watchdog ruled yesterday.

A computer's internet protocol (IP) address - a number used by computers to identify and communicate with each other on the network - was not personal data and could not reveal a person's identity, Privacy Commissioner for Personal Data Roderick Woo Bun said.

Mr Woo was announcing the results of an inquiry into a complaint that by disclosing the IP address of Shi's computer, Yahoo had helped the mainland authorities track him down.

The complaint was against Yahoo Hong Kong, but the company continued to insist yesterday that the information had been provided by Yahoo China, over which it had no control.

The commissioner's contention was attacked by journalists and an expert on internet service provision, who said that while an IP address could not show a person's identity, confirming it to mainland authorities had led to the revelation of the journalist's identity.

Shi was convicted in April 2005 of illegally providing state secrets to foreign entities and was jailed for 10 years.

He had been accused of sending notes containing contents of a top-secret document through his Yahoo e-mail account on April 20, 2004.

Disclosing the report of the inquiry, which began in May last year, Mr Woo said revealing a user's IP address, which is a sequence of numbers, did not contravene privacy law as the address would not reveal a person's identity. Even looking at the registration name, 'such as Andy Lau', would not identify the user, he said.

'There are many Andy Laus and it is not possible [for the mainland authorities] to identify the user's identity.'

But a former president of the Internet Service Providers Association, Charles Mok Nai-kwong, said Mr Woo's comment was misleading.

'Yahoo gave this information with clear knowledge that just by matching the IP address with other information can find the identity. This is in fact revealing personal data,' he said.

The report also stated there was insufficient evidence to prove that the journalist's personal data were disclosed by Yahoo Hong Kong to the mainland authorities.

Yahoo faced an international outcry after it was revealed it had given information about Shi to the authorities. It responded by arguing that it had to abide by the laws of countries where it operated.

Yesterday Yahoo Hong Kong spokeswoman Pauline Wong Yuen-nan said that the IP address was provided by Yahoo China in Beijing, which ran independently from its Hong Kong office.

But she added that it was wholly owned by Yahoo Hong Kong (Holdings) when the information was provided.