On Wednesday October 19, 2016 the Court of Justice of European Union (“CJEU”) issued its judgment in Case C-582/14, Patrick Breyer v Germany. 

The CJEU held that a “dynamic” IP address constitutes personal data (agreeing with the Opinion of the Advocate General from May this year).  Dynamic IP addresses qualify as personal data, even if the website operator in question cannot identify the user behind the IP address, since the users’ internet service or access providers (“ISPs”) have data that, in combination with the IP address, can identify the users in question.

The CJEU concluded that domestic law — in this case, German law — could not adopt a more restrictive interpretation of the “legitimate interests” legal basis for processing than is set out under the EU Data Protection Directive.  In that vein, the continued processing of personal data, without the user’s consent, may be justified as falling within a legitimate interest — e.g., ensuring the continued security or functioning of those websites including to protect against cyberattacks.

Background

The CJEU was asked, through a preliminary ruling reference from the German Supreme Court, to answer two questions regarding the interpretation of certain provisions of the Data Protection Directive.  These referred questions essentially asked whether:

  1. dynamic IP addresses qualify as personal data; and
  1. such data may be processed by a website operator in order to ensure the security and functioning of the website.

(For the exact wording of the two questions that have been referred to the Court for a so-called preliminary ruling, see here.)

These questions arose in court proceedings in Germany that had been initiated by Mr Breyer, a German Pirate Party politician, against the German Federal Government.  Mr Breyer was, in essence, seeking to prevent German Federal institutions that operated web sites from storing his IP address for longer than the period in which he accessed and used those sites.  The Federal institutions that operated the sites could not identify users solely from the IP addresses and information that they held; in order to identify users, they would need to combine data that they held with data retained by ISPs.

CJEU decision

(1)        Dynamic IP addresses as personal data

“Personal data” is defined in Article 2(a) of the Data Protection Directive as any information relating to an identified or identifiable natural person (a “data subject”).   A data subject is one who can be identified, directly or indirectly.  In light of the word “indirectly”, the CJEU relied on Recital 26 of the Data Protection Directive, which states that “to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person.” (Emphasis added.)  In other words, “it is not required that all the information enabling the identification of the data subject must be in the hands of one person” (para. 43, Judgment).  In this context, the CJEU held that additional data held by an internet access provider would “likely reasonably” by someone used to identify the data subject.

(2)       Processing personal data in order to ensure the security and functioning of the website

The real issue for the CJEU in considering this second question was whether German domestic law could provide for a more narrow set of circumstances permitting the continued processing of personal data without consent than that envisaged under the Data Protection Directive.  Specifically, section 15 of the German Telemedia Act (“TMG”) allows the collection and use of telemedia users’ usage data in limited circumstances, but not for the purpose of ensuring the general operability (i.e., the security and functioning) of the telemedia service.

Past CJEU case law is clear that Member States are precluded from prescribing the outcome of the balancing of competing interests and rights under Article 7(f) of the Data Protection Directive (Joined Cases C‑468/10 and C‑469/10 ASNEF and FECEMD (see here)).  Article 7(f) of the Data Protection Directive allows data processing if “necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject.  Accordingly, the CJEU held that Article 7(f) of the Data Protection Directive precluded the application of section 15 of the TMG which applied too strict and narrow an interpretation of “legitimate interests”.  The result, although not made explicit by the CJEU, is that website operators may have a legitimate interest in ensuring the continued security or functioning of their websites (e.g., to prevent cyberattacks).

Commentary and next steps

 The decision is significant in a number of respects.

  • Dynamic IP addresses are now considered personal data — an issue that has been uncertain for some time.
  • More generally, the CJEU’s reasoning in response to the first question follows the line of thinking that data may be personal data, provided someone, somewhere, can associate it with the individual.  This need not be the entity actually possessing the data.  This reasoning is not necessarily currently shared across all Member States and so the decision may cause Member States to consider their own interpretations and applications of the term “personal data” prior to the GDPR becoming applicable in May 2018.
  • The decision seems likely to have an impact on how certain legislators and enforcement authorities view de-identified and key-coded data, perhaps applying stricter standards.
  • It is helpful for organizations processing data that the CJEU’s scoping of “legitimate interests” continues to be broad and implicitly acknowledges that organizations may rely on “legitimate interests” to process dynamic IP addresses.
  • The CJEU did not explicitly rule on what is or is not a “legitimate interest”.  Provisions in the Data Protection Directive and GDPR, guidance from data protection authorities, and other case law will help determine this.

The case will now be sent back to the German Federal Court of Justice, which will deliver a judgment applying the CJEU’s ruling.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as Privacy International and the European security agency, ENISA.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.