The problem is that more and more companies are using geo-location databases to try and confirm if their users are within a certain area. One example was National Lottery refusing to allow a customer to buy a ticket as he was supposedly outside the UK. We was in Gloucester which is well within the UK! He now has issues with O2's retail on-line shop.
It is a concern when there is wrong data, but I am not convinced this is covered by things like the DPA as it is not really personal. I hope that, in general, an IP address is not personal, but there may be cases where it is.
What bugs me is that there is a definitive database of the country in which all EU IP addresses are located, and that is the RIPE whois. As an ISP we carefully ensure that this is correct (almost all of our IPs are in the UK). If someone wants to know if an IP is in the UK, the whois database will tell them - so why do geo-location companies make up incorrect data? The sort of people that want to use geo-location data are normally advertises who apparently want to offer you "girls waiting for you in Arnold, Nottinghamshire" for some reason :-)
It is also a concern that the National Lottery help page on this (they have one, suggesting this is really a problem) says to contact your ISP. Why on earth would they say that? It is not the ISP telling them that the IP is in another country. Then if you do get hold of them they apparently create some amazing bullshit to try and explain it!
This is what I have just sent to the ICO:-
I am trying to establish the extent to which an Internet Protocol (IP) address and location information which as been associated with the IP address can be considered "personal data", and if this can give rise to obligations on a Data Controller to correct errors. The specific issue is where companies have information supposedly identifying the location of an IP address, and that information is incorrect. We are having trouble getting the information corrected. A specific case we have had recently involves the National Lottery. They incorrectly identified an IP address as being in Guernsey when it is in the UK, and so would not allow access to their web site to make use of their services. We also have the issue with O2 (mobile). I can see this becoming a more and more common problem. In this specific case the IP address happens to be permanently routed to a specific personal computer on a desk in Gloucester and there is an identifiable individual that uses that computer and no other. Does advising them of the name associated with the IP address make the information related to that IP address "personal data"? Would this then allow us to required that they correct this incorrect personal data (i.e. the wrong location information) under the Data Protection Act? Or are they under such an obligation anyway by some aspect of the Act? I look forward to your reply. Adrian Kennard, Director, Andrews & Arnold Ltd
I hate geolocation. I work for an American company in London and all of our internet access is via New York. Which means quite a few sites don't work, many sites give you wrong defaults, and sites like the BBC gives quite different news from when you access it from the UK. If they can't do it right, they shouldn't do it at all.
ReplyDeleteMike B's /24 block shows an Guernsey, we wondered if this was by design, but I'm guessing not
ReplyDeleteTests we did suggested it was a /26 within his /24 that showed as Guernsey, and no, not intentional.
Deleteiphones and ipods on my network (AAISP IPs) often set their clocks to be somewhere in the far east. I've not investigated exactly why but my hunch is that is where Apple think my IPs are.
ReplyDeleteGoogle seems to think my A&A range is in Cambridge - which is more irritating than anything else... The most annoying part is my powerlessness to correct it. I did email them, but I'm not sure it's helped. TBH I've not checked for a while.
ReplyDeleteThis comment has been removed by a blog administrator.
ReplyDeleteGoing slightly off-topic, but Android's wifi geolocation seems to be quite brain-dead too. An Android phone typically has access to the following information to try and locate you:
ReplyDelete- Which cellular base station you're connected to at the moment
- Which Wifi networks are visible
- GPS
Obviously, GPS is usually not used since it increases battery consumption. Due to the typically large range of cellular base stations, this usually gives the worst accuracy, so Android usually uses wifi in preference. However, wifi access points move around the country/world, so you can't always trust that they are where Google's database says they are. But on several occasions, I've seen Android's geolocation get it completely wrong by looking up the location for a single wifi access point and using that, even though there are about 5 other APs and a cell tower which would provide the correct information. You would've thought they would check the location for all possible location sources and discard the one incorrect location if all the other locations roughly agree with each other.
Best to find out what geo-location service O2 is using. Look here (http://nanog.cluepon.net/index.php/GeoIP) for information on how to look up the location reported by some popular GeoIP services and also how to request they be updated or corrected.
ReplyDeleteI appreciate this is old but but I've encountered this problem too on my aaisp connection. I've done a bit of research and it looks like the UK National Lottery use Neustar for their geolocation data. The problem is Neustar use reverse DNS if it exists and then use the TLD from that to indicate location. So as an example for a .cx domain would place you on Christmas Island ...
ReplyDelete