On Wednesday October 19, 2016 the Court of Justice of European Union (“CJEU”) issued its judgment in Case C-582/14, Patrick Breyer v Germany. 

The CJEU held that a “dynamic” IP address constitutes personal data (agreeing with the Opinion of the Advocate General from May this year).  Dynamic IP addresses qualify as personal data, even if the website operator in question cannot identify the user behind the IP address, since the users’ internet service or access providers (“ISPs”) have data that, in combination with the IP address, can identify the users in question.

The CJEU concluded that domestic law — in this case, German law — could not adopt a more restrictive interpretation of the “legitimate interests” legal basis for processing than is set out under the EU Data Protection Directive.  In that vein, the continued processing of personal data, without the user’s consent, may be justified as falling within a legitimate interest — e.g., ensuring the continued security or functioning of those websites including to protect against cyberattacks.

Background

The CJEU was asked, through a preliminary ruling reference from the German Supreme Court, to answer two questions regarding the interpretation of certain provisions of the Data Protection Directive.  These referred questions essentially asked whether:

• dynamic IP addresses qualify as personal data; and

• such data may be processed by a website operator in order to ensure the security and functioning of the website.

(For the exact wording of the two questions that have been referred to the Court for a so-called preliminary ruling, see here.)

These questions arose in court proceedings in Germany that had been initiated by Mr Breyer, a German Pirate Party politician, against the German Federal Government.  Mr Breyer was, in essence, seeking to prevent German Federal institutions that operated web sites from storing his IP address for longer than the period in which he accessed and used those sites.  The Federal institutions that operated the sites could not identify users solely from the IP addresses and information that they held; in order to identify users, they would need to combine data that they held with data retained by ISPs.

CJEU decision

(1) Dynamic IP addresses as personal data

“Personal data” is defined in Article 2(a) of the Data Protection Directive as any information relating to an identified or identifiable natural person (a “data subject”).   A data subject is one who can be identified, directly or indirectly.  In light of the word “indirectly”, the CJEU relied on Recital 26 of the Data Protection Directive, which states that “to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person.” (Emphasis added.)  In other words, “it is not required that all the information enabling the identification of the data subject must be in the hands of one person” (para. 43, Judgment).  In this context, the CJEU held that additional data held by an internet access provider would “likely reasonably” by someone used to identify the data subject.

(2) Processing personal data in order to ensure the security and functioning of the website

The real issue for the CJEU in considering this second question was whether German domestic law could provide for a more narrow set of circumstances permitting the continued processing of personal data without consent than that envisaged under the Data Protection Directive.  Specifically, section 15 of the German Telemedia Act (“TMG”) allows the collection and use of telemedia users’ usage data in limited circumstances, but not for the purpose of ensuring the general operability (i.e., the security and functioning) of the telemedia service.

Past CJEU case law is clear that Member States are precluded from prescribing the outcome of the balancing of competing interests and rights under Article 7(f) of the Data Protection Directive (Joined Cases C‑468/10 and C‑469/10 ASNEF and FECEMD).  Article 7(f) of the Data Protection Directive allows data processing if “necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject.”  Accordingly, the CJEU held that Article 7(f) of the Data Protection Directive precluded the application of section 15 of the TMG which applied too strict and narrow an interpretation of “legitimate interests”.  The result, although not made explicit by the CJEU, is that website operators may have a legitimate interest in ensuring the continued security or functioning of their websites (e.g., to prevent cyberattacks).

Commentary and Next Steps

The decision is significant in a number of respects.

• Dynamic IP addresses are now considered personal data — an issue that has been uncertain for some time.

• More generally, the CJEU’s reasoning in response to the first question follows the line of thinking that data may be personal data, provided someone, somewhere, can associate it with the individual.  This need not be the entity actually possessing the data.  This reasoning is not necessarily currently shared across all Member States and so the decision may cause Member States to consider their own interpretations and applications of the term “personal data” prior to the GDPR becoming applicable in May 2018.

• The decision seems likely to have an impact on how certain legislators and enforcement authorities view de-identified and key-coded data, perhaps applying stricter standards.

• It is helpful for organizations processing data that the CJEU’s scoping of “legitimate interests” continues to be broad and implicitly acknowledges that organizations may rely on “legitimate interests” to process dynamic IP addresses.

• The CJEU did not explicitly rule on what is or is not a “legitimate interest”.  Provisions in the Data Protection Directive and GDPR, guidance from data protection authorities, and other case law will help determine this.

The case will now be sent back to the German Federal Court of Justice, which will deliver a judgment applying the CJEU’s ruling.