[2008] 1 HKC Shi Tao v Privacy Commissioner for Personal Data (Administrative Appeals Board) 299 A plaintiffs’ copyright in music works in unauthorised uploading of the same onto the Internet using ‘P2P’ file sharing programmes. 58. It was explained at paras 12 to 14 of the judgment that the IP address can be utilised in the following manner: B ‘12. But if need be, the infringer can still be tracked down. The clue is the Internet Protocol Address (IP Address), which is a unique number to enable the subscriber’s computer to communicate with other computers on the Internet. An ISP assigns to its subscriber an IP Address. Whenever a computer is connected to the Internet the ISP concerned will assign to it an IP Address. Depending on the ISP’s practice it is possible that a different IP Address is assigned every time when the same computer is being connected to the Internet. An IP Address itself does not directly reveal the identity of the subscriber. But the ISP can track the IP Address at a specific time or period to the records of their subscribers, which include names, Hong Kong ID card numbers and addresses. C D E F G H I 13. In short, by cross checking the IP Address marked at a specific time or period with the ISP’s records, the identity and address of the subscriber, whose computer has been used to upload the music files on the Internet by P2P program, including the WinMX software can be revealed. 14. Accordingly, with the assistance of the ISPs, the cloak of anonymity can be pierced and the true identity of the infringers may be revealed.’ 59. As stated above, the Commissioner accepted that an IP address, together with other data, could in certain circumstances constitute ‘personal data’. 60. Mr Denis Chang SC, appearing on behalf of the Commissioner contended that the question in this appeal was not whether any personal data had been disclosed, but whether personal data of the appellant had been disclosed by YHHK. Mr Chang argued that in the circumstances of the present case, there was insufficient evidence to support that the two limbs of the definition of ‘personal data’ (ie data (1) relating directly or indirectly to a living individual; and (2) from which it is practicable for the identity of the individual to be directly or indirectly ascertained) had been met. 61. Mr Chang relied on an English Court of Appeal case, Durant v Financial Services Authority [2003] EWCA Civ 1746, in which there were dicta to the effect that in order for the data to relate to an individual, it should have biological significance in relation to that individual, and should also have him as the focus. 62. We agree with Mr Chang that on the facts of the present case, the IP log-in information provided by Beijing Yahoo!, even when coupled with other information disclosed, did not constitute ‘personal data’ as defined under the Ordinance. 63. The only piece of evidence which the appellant has adduced in support of his complaint against YHHK is the Verdict, However, the