Deliverable 4.5 analyses the personal data issues that the deployment and use of IPv6 may involve in the information society by means of the precise analysis of different cases to which this protocol shall be applicable. In particular, we analyse legal issues arising out of the use of this protocol in mobile telephony, personal computers and household appliances. After the analysis of these matters, we suggest certain alternatives or proposals with the purpose of sorting out or, if applicable, minimizing the legal issues explained throughout this Deliverable.
The widespread use of IPv6 could have legal consequences that have been taken into account whilst developing the Protocol. Some of these legal consequences are the implications that IPv6 might have on the right to privacy and data protection. These matters are based on the fact that, under some circumstances, an IP address based on the Internet Protocol version 6 could be considered personal data because it could contain in its configuration a Unique Identifier which could be linked directly to the interface of the terminal that is using this IP and indirectly to its user, whom might be an individual.
One of the main scopes of this document is to analyse the current legislation on data protection adopted by the different Member States of the European Union with the purpose of determining if it might be applied initially to IPv6 or, on the other hand, if it would be necessary to adopt a specific legal legislation for IPv6. Therefore, there are two Directives which are going to be analysed by this Deliverable: Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and the Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.
Also, the implementation of IPv6 has some important consequences regarding the processing of personal data. First of all, the IP address itself is considered personal data and, therefore, its processing is bound by this legislation. Secondly, all the information that could be related by a third party to an IP address based on an Unique Identifier, for example the information obtained by this third party about the Internet use or the results of surfing the Net by a specific user, might also be considered as personal data because at the end, it could be linked, using certain means, to its owner or data subject.
There are some means that could be used by a company or individual to link an IP address to its holder, for example, a contract or using public directories. The creation and use of these means will be analysed in detail in this document. To conclude, this Deliverable aims to provide a wide perspective concerning the implications, problems and advantages that the implementation of IPv6 would have regarding the privacy and data protection of its users.