A/HRC/23/40 66. In delivering services to their users, communications service providers give subscribers’ devices or network an Internet Protocol (IP) address45 that changes periodically. Information about an IP address can be used to ascertain the identity and location of an individual and track their online activity. Mandatory data retention laws force communications service providers to keep records of their IP address allocations for a certain period of time, allowing the State greater ability to require communications service providers to identify an individual on the basis of who had a given IP address at a particular date and time. Some States are also now seeking to compel third party service providers to collect and retain information that they would not normally collect. 67. National data retention laws are invasive and costly, and threaten the rights to privacy and free expression. By compelling communications service providers to create large databases of information about who communicates with whom via a telephone or the Internet, the duration of the exchange, and the users’ location, and to keep such information (sometimes for years), mandatory data retention laws greatly increase the scope of State surveillance, and thus the scope for infringements upon human rights. Databases of communications data become vulnerable to theft, fraud and accidental disclosure. G. Identity disclosure laws 68. In many States, laws require the provision of identification at cybercafés. Such laws are particularly problematic in countries where personal computer ownership is low and individuals rely heavily on publicly available computers. In India, for example, the Information Technology (Guidelines for Cyber Cafes) Rules 2011 require that cybercafé owners obtain identification documents from any individual visiting the cybercafé, which records must be kept for at least one year (Rule 4(2)). The cybercafé must maintain a logregister, containing, among other information, log in time and log out time, and computer terminal identification for a minimum period of one year (Rule 5(1) & 5(2)); store and maintain backups of log records of each access or login by any user for at least one year (Rule 5(4)). 69. Individuals are now also required to use their real names online in many States, and to provide official identification in order to establish their identity. In the Republic of Korea, the Information Communications Law, adopted in 2007, required users to register their real names before accessing websites with more than 100,000 visitors per day, ostensibly in order to reduce online bullying and hate speech. The law was recently overturned by the Constitutional Court on the basis that it restricted freedom of speech and undermined democracy.46 China recently adopted the Decision to Strengthen the Protection of Online Information, requiring Internet and telecommunications providers to collect personal information about users when they sign up for Internet access, landline, or mobile phone service. Service providers allowing users to publish online are required to be able to link screen names and real identities. These real name registration requirements allow authorities to more easily identify online commentators or tie mobile use to specific individuals, eradicating anonymous expression. 47 45 46 47 18 An IP address is a unique numeric code that identifies all computers or other devices connected to the Internet. Constitutional Court Decision 2010Hun-Ma47 (“Real names” decision), 23 August 2012. An official summary of the Court’s decision is available on the Court’s website at http://www.ccourt.go.kr/home/bpm/sentence01_list.jsp only in Korean. "China to Strengthen Internet Information Protection" http://www.ebeijing.gov.cn/BeijingInformation/BeijingNewsUpdate/t1292298.htm.