Advocate General: Dynamic IP address can be personal data
On 12 May Manuel Campos Sánchez-Bordona, Advocate General (AG) of the European Court of Justice (CJEU), gave his opinion in the Case Patrick Breyer against the Federal Republic of Germany, C-582/14.
Patrick Breyer sued the German government for violating his right to data protection by storing the data about him visiting websites of the German government longer than necessary. The government’s websites use so-called “logs” that keep record of which particular dynamic IP address was having access to the service. Breyer claims that the storage of this data constitutes a processing of personal data, which is protected under the Data Protection Directive 95/46/EC. According to the Directive, such processing of personal data is generally unlawful, unless it is justified, for example by a previously given consent. The Republic of Germany, however, stated that the logs to its website are essential for its functioning, as they are important for preventing abuse and prosecuting network attacks. In the ongoing procedure, the German Federal Court of Justice (BGH) eventually forwarded two questions to the CJEU, asking for preliminary ruling.
The first question was addressing the issue whether a dynamic IP address, together with the time of access, constitute personal data according to Article 2 (a) of the Data Protection Directive. The question referred specifically to whether a person is already “identifiable” if the information which is necessary to identify an individual has to be provided by a third party, in this case a telecommunication company. The Advocate General followed Breyer’s legal submissions in his opinion, stating that the definition of personal data also encompasses dynamic IP addresses, as long as an Access Provider holds additional information enabling the identification of an individual.
The Advocate General’s position directly contradicts the position of the Irish High Court in EMI Records & Ors -v-Eircom Ltd from 2010. In that case, Mr Justice Charleton (now elevated to the Irish Supreme Court), having explained that the internet is not “an amorphous extraterrestrial body” (paragraph 5), ruled that IP address data collected for the explicit purpose of identifying individuals in the context of copyright enforcement is not personal data.
The Advocate General’s view is also in line with an opinion from 2009 by the Article 29 Working Party (WP29), an independent body with advisory status regarding data protection, which was set up according to the Data Protection Directive. Back then, the WP29 considered that IP addresses can be personal data, even though they do not generally identify an individual by name.
The second question was assessing whether restrictions of data processing under the German Telemedia Act (§15 TMG), which lead to a prohibition of the processing, may violate the Article 7 (f) of the Data Protection Directive. The provision states that personal data may be processed, if it is necessary for the purposes of legitimate interest of the processor. However, the German Telemedia Act (TMG) allows the collection and use of users’ data in only limited circumstances, but not for the purpose of ensuring the general operability of the telemedia service. The AG claims that the purpose of a functioning of “telemedia” (as defined in §1 TMG) constitutes a legitimate interest according to the Directive and should therefore be permitted, when it prevails over the interests or the fundamental rights of the concerned person.
Patrick Breyer stated in reaction to the opinion that
nobody has a right to record everything we do and say online. Generation Internet has a right to access information online just as unmonitored and without inhibition as our parents read the paper, listened to the radio or browsed books.
The European Court of Justice did not yet set a date for the final decision.
Request for a preliminary ruling of the German Bundesgerichtshof (17.12.2016) http://curia.europa.eu/juris/document/document.jsf?text=&docid=162555&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=801346
The 2009 opinion by the Article 29 Working Party (20.06.2016) http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp136_en.pdf
Opinion of the Advocate General (only in German, 12.05.2016) http://curia.europa.eu/juris/document/document.jsf?text=&docid=178241&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=810242
EMI Records & Ors -v-Eircom Ltd (16.04.2010)
http://www.bailii.org/ie/cases/IEHC/2010/H108.html
(Contribution by Claudius Determann, EDRi intern)
