298 Hong Kong Cases [2008] 1 HKC registration information, IP log-in information and certain email contents, was not ‘personal data’ within the definition of the Ordinance; (2) The Commissioner erred in law and in fact in finding that YHHK was not a ‘data user’ and had no control over the data disclosure of the personal data in question, (3) The Commissioner erred in law and in fact in finding that the Ordinance had no extra-territorial application to and had no jurisdiction over the act of disclosure of the personal data under complaint; (4) The Commissioner erred in law and in fact in finding that the disclosure of the personal data in question did not contravene DPP3. F. GROUND ONE: WHETHER IP ADDRESS TOGETHER WITH RELEVANT DATA DISCLOSED CONSTITUTE PERSONAL DATA 53. According to the Report, Yahoo! Inc confirmed that Beijing Yahoo! had provided to the SSB the following information (i) user registration information; (ii) IP log-in information; and (iii) certain email contents. 54. Mr Albert Ho Chun Yan, on behalf of the appellant, submitted that the question for determination by the Commissioner was not whether an IP address per se constituted personal data. Rather, the question should be whether the IP address, together with the other relevant data disclosed in this case, constituted personal data. He forcefully argued that such information taken together served as a key to further investigation by the PRC authorities, leading to the appellant’s arrest and conviction. 55. Mr Ho submitted that according to the Verdict, the information provided by Beijing Yahoo! disclosed the telephone number and business address of the newspaper that the appellant worked for. The transaction time and date were also provided. The computer that was used to send out the relevant email was traced via the IP address provided. Mr Ho argued that it would not be difficult for one to ascertain the identity of the user of that particular computer in the office, at or during that particular period of time. 56. Mr Ho relied on Cinepoly Records Co Ltd & Ors v Hong Kong Broadband Network Ltd & Ors [2006] 1 HKC 433, [2006] 1 HKLRD 255 as an illustration of how an IP address might be used to track down the identity of a certain data subject. 57. In the Cinepoly case, the plaintiffs were music companies. They sought Norwich Pharmacal relief (ie, disclosure of information in the possession of the defendant relating to alleged civil wrongs committed against the plaintiff) against the defendant internet service provider, seeking the names, Hong Kong identity card numbers and addresses of 22 defendant subscribers. These subscribers were allegedly in breach of the A B C D E F G H I