In Breyer vs. Germany (Case C‑582/14) the European Court of Justice concluded that the IP address used when browsing the Internet come under the protection of the data protection directive if there are legal means for operators of online services to have offenders prosecuted using their IP address. In consequence Internet content providers such as Google or Facebook may retain an IP address only if they have a legitimate interest in it outweighing the user’s right to privacy. In my opinion there is a prevailing interest in using online media anonymously and without tracking, meaning that a blanket retention of all users IP addresses is illegal (this question is yet to be decided).
Industry lawyers from White&Case are now trying to find a loophole: In an essay they argue that the General Data Protection Regulation sets a different standard when saying:
To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.
They argue that is is unlikely that a random user’s IP address would ever be identified. But this argument is completely misleading.
An IP address comes under the data protection rules if the subscriber is identifiable by it. It does not matter whether the subscriber will ever be identified (of which they can never be sure), the mere possibility of identification suffices for the sake of safeguarding privacy and preventing self-censorship. The subscriber is identifiable if there are means reasonably likely to be used to identify them when a need for identification arises. The likeliness test applies to the means of identification (such as law enforcement requests), not to the identification itself. The regulation does not say a person is identifiable only if it is likely to be identified; that would be a contradiction.
The lawyers are also misrepresenting the ruling in another way: Although the ECJ’s test in par. 49 is whether a website operator can use an IP address to identify the subscriber, the Court explains in par. 47 that it suffices if „in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings“. Therefore it does not matter legally whether website operators can themselves obtain subscriber data, but whether they can have subscribers identified by law enforcement agencies. In other languages par. 49 of the ruling makes this clearer:
…constitue, à l’égard dudit fournisseur, une donnée à caractère personnel au sens de cette disposition, lorsqu’il dispose de moyens légaux lui permettant de faire identifier la personne concernée…
…ein personenbezogenes Datum im Sinne der genannten Bestimmung darstellt, wenn er über rechtliche Mittel verfügt, die es ihm erlauben, die betreffende Person anhand der Zusatzinformationen, über die der Internetzugangsanbieter dieser Person verfügt, bestimmen zu lassen.
I have applied for the English ruling to be rectified in par. 49 as follows:
…in relation to that provider, where the latter has the legal means which enable it to have the data subject identified.
But even without this rectification the notion of identifiability is clear from the other languages and par. 47 of the ruling.
In conclusion beware of industry lawyers trying to undermine Internet privacy.
More information: Top EU Court: IP adresses are personal data
|Beitrag per E-Mail versenden||Seite drucken|
- Nackt im Netz durch Surfprotokollierung? Surfer haben ein Recht auf Privatsphäre! (14.2.2017)
- EuGH korrigiert Urteil zu Internet-Überwachung (13.1.2017)
- Berichtigung des EuGH-Urteils zur Surfprotokollierung / Personenbezug von IP-Adressen beantragt (26.10.2016)
- EuGH-Urteil: Piraten fordern europaweites Verbot der Surfprotokollierung (19.10.2016)
- Top EU Court: IP adresses are personal data ()