When the order was made that Google provide Viacom with its raw user logs (a move which significantly compromised user privacy), I wrote that the court could have ordered that the information be anonymised. (Canadian Privacy Law Blog: Commentary on the YouTube / Viacom order)
I don't think I can take any credit for this next move, but I'm sure the loud outcry has had an influence: Google and Viacom have agreed to anonymise the data using a one-way function so that the actual IP addresses cannot be reverse-engineered and Viacom has agreed to not even try. The stipulation filed with the court is here. Extract:
IT IS HEREBY STIPULATED AND AGREED, by and between the undersigned
counsel of record:1. Substituted Values: When producing data from the Logging Database
pursuant to the Order, Defendants shall substitute values while preserving uniqueness for
entries in the following fields: User ID, IP Address and Visitor ID. The parties shall
agree as promptly as feasible on a specific protocol to govern this substitution whereby
each unique value contained in these fields shall be assigned a correlative unique
substituted value, and preexisting interdependencies shall be retained in the version of the
data produced. Defendants shall promptly (no later than 7 business days after execution
of this Stipulation) provide a proposed protocol for this substitution. Defendants agree to
reasonably consult with Plaintiffs’ consultant if necessary to reach agreement on the
protocol.2. Non-Circumvention: The parties agree that they shall not engage in any
efforts to circumvent the encryption utilized pursuant to Paragraph 1 this Stipulation.
This Paragraph does not limit in any way any party’s rights under Paragraph 8 below.
For background, see all posts tagged: Viacom v Google. Also, the Ontario Privacy Commissioner applauds this move: CNW Group | OFFICE OF THE INFORMATION AND PRIVACY COMMISSIONER/ONTARIO | Commissioner Cavoukian Applauds Agreement Protecting YouTube Users' Privacy
