French Court says an IP address is not enough for a user's identification
This article is also available in:
Deutsch: [Französisches Gericht: IP-Adressen reichen für die Identifikation eines Users nicht aus| http://www.unwatched.org/node/1726]
The Paris Appeal Court has recently ruled that an IP address does not allow
the identification of an Internet user and therefore needs no prior
authorization from CNIL (National Commission for Information Technologies
and Civil Liberties) to be collected.
The decision comes to support the ruling of the Cassation Court of 13
January 2009 stating that the collection of an IP address by the collective
society SACEM agents was not to be considered as automatic treatment of
personal data, thus reversing a previous decision of the Rennes Appeal Court
of May 2009 which had considered the IP address as nominal data for the
collection of which the prior authorization of the CNIL was needed.
According to the French Data Protection Act, sworn agents may process
data related to offences, convictions, and safety measures on behalf of
rights holders of victims of copyright infringements in order to ensure the
defense of these rights but such processing, automatic or not, has to be
previously authorized by the CNIL.
However, the Court of Cassation considered that such a sworn agent does not
need a prior CNIL authorization if he accesses manually a person’s list of
files uploaded onto a peer-to-peer network in violation of copyrights. In
the court’s opinion, the collection of an IP address in order to find the
user’s identity through his ISP does not constitute data processing.
While the Court of Cassation did not express a view as to whether an IP
address qualifies as personal data, the Appeal Court considers the IP
address as the material evidence of the infringement and cannot be
considered personal data because it does not identify the user.
The court also rejected the private copy exception by considering it “is not
applicable to downloading, the purpose of using p2p software being exactly
that of sharing and exchanging files between users (…).”
Justice: the IP address is not enough to identify a pirate (only in French,
18.02.2010)
http://www.numerama.com/magazine/15105-justice-l-adresse-ip-n-est-pas-suffisante-pour-identifier-un-pirate.html
French Court of Cassation Rules on Data Protection and Online Copyright
Infringement (11.02.2010)
http://www.huntonprivacyblog.com/2009/02/articles/french-court-of-cassation-rules-on-data-protection-and-online-copyright-infringement/