Articles

Quod personalis notitia Iovi, non personalis notitia bovi

Quod personalis notitia Iovi, non personalis notitia bovi

Quod personalis notitia Iovi, non personalis notitia bovi

24.02.2017

In its decision of 19 October 2016, the Court of Justice of the European Union ("CJEU") clarified the concept of personal data. The Court held that an IP address can be qualified as personal data, even if the processor could only identify the actual user through information on the IP address held by an Internet Service Provider ("ISP").

Personal data, which are pivotal in the application of Data Protection Directive 95/46/EC ("the Directive"), are broadly defined as any information relating directly or indirectly to an identifiable natural person.

The case that led to the submission of questions to the CJEU for a preliminary ruling is about the German politician Mr Patrick Breyer (Pirate Party) who visited several websites operated by German Federal institutions. The website operator (the Federal German Government) stored information on the IP addresses of its visitors. Breyer argued that his IP address qualifies as personal data and that therefore, pursuant to the Directive, the website operator would have to obtain Breyer's consent to store his IP address. The Federal German Government was of the opinion that the IP address did not qualify as personal data, so the issue ended up before the Bundesgerichtshof (Federal Court of Justice, Germany) and this Court submitted the preliminary questions to the CJEU.

The CJEU began by reaffirming its previous ruling in the Scarlet Extended case in which it essentially held that the IP addresses of internet users were protected personal data because they allow users to be precisely identified.1] However, that finding related to the specific situation in which the collection and identification of the IP addresses of internet users are carried out by ISPs.[2]

What makes this case different to the Scarlet Extended case is that it is not the ISP but rather the website operator who is collecting the IP addresses of website visitors. The Federal German Government does not have direct access to the additional data that are necessary for it to identify the user behind the IP address because that information is held by the ISP. Furthermore, the IP address from Breyer was a "dynamic IP address" that changes every time the user connects to a network, making identification of the user virtually impossible without additional information from the ISP.

The CJEU notes that it is common ground that a dynamic IP address as such does not qualify as personal data, since such an address does not directly reveal the identity of the natural person who owns the computer from which a website was accessed. To identify a natural person behind a dynamic IP address, additional data is needed, and such data is held by the ISP and not by the website operator.

The CJEU continued by investigating whether a dynamic IP address can qualify as personal data if there is indirect access to such information held by the ISP. The CJEU noted that if the information needed from the ISP is legally or practically unobtainable, the risk of user identification by the website operator appears in reality to be insignificant.[3] However, the CJEU held that dynamic IP addresses are personal data if the website operator has "the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person."

As for the specific case at hand, the CJEU considered that for cyberattacks, website operators do have access to legal channels that enable them to obtain the information from the ISP to identify the data subjects behind the dynamic IP addresses. This consideration is subject to verification to be performed by the German Federal Court. If the German Federal Court finds this consideration valid, then Breyer's dynamic IP address will qualify as personal data.

In this ruling, the CJEU introduces a further “subjective” or “relative” criterion to define personal data. Whether information is personal data depends on the capability of the processor to identify the natural person behind the data. Although this criterion stems directly from the wording of the Directive/GDPR, one can easily see that it can lead to qualification issues.

The case (C-582/14) can be found here.

 

[1]ECLI:EU:C:2016:779 paragraph 33 (Breyer) referencing to ECLI:EU:C:2011:771 paragraph 51 (Scarlet Extended).

[2] We note that the European Data Protection Authorities ("DPAs") broadened the scope even further by concluding that every static IP address is, or should be treated as, personal data, since in theory it would be possible to gather enough information about the browsing history of an individual so that he or she could be identified.

[3] ECLI:EU:C:2016:779 paragraph 46 (Breyer)

Team

Related news

02.07.2019 NL law
Debate night: HR Analytics: opportunity or threat?

Seminar - On 2 July 2019, Stibbe's Digital Economy Group will host a debate night in Amsterdam on the hot topic of HR analytics. During Stibbe's debate night, speakers from the world of business, politics, science and law will exchange views on HR analytics, how they can be used in practice, and their development in the context of employment and privacy law.

Read more

06.06.2019 NL law
Masterclass: Alcohol and drug testing in the workplace

Masterclass - Stibbe will host a masterclass entitled 'Alcohol and drug testing in the workplace' on 6 June in Amsterdam. During this masterclass, employment law expert Johan Zwemmer and privacy experts Frederiek Fernhout and Judica Krikke will discuss the Dutch Data Protection Authority's general prohibition of these tests and discuss whether and how employers should implement.

Read more

07.06.2019 BE law
Part three - GDPR and public law: To retroact or not?

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss the retroactive application of GDPR.

Read more

06.06.2019 NL law
Masterclass: Alcohol- en drugstesten op de werkvloer

Masterclass - Stibbe in Amsterdam organiseert op 6 juni de masterclass 'Alcohol- & drugstesten op de werkvloer'. Tijdens deze masterclass bespreken arbeidsrechtexpert Johan Zwemmer en privacydeskundigen Frederiek Fernhout en Judica Krikke het algemene verbod van de Autoriteit Persoonsgegevens op deze testen voor werkgevers en leggen zij onder meer uit hoe hiermee moet worden omgegaan.

Read more

06.06.2019 BE law
TMT Roundtable: Getting a handle on software quality

Roundtable - Erik Valgaeren, TMT Partner at Stibbe Brussels, and his team organize a roundtable on software quality in our Brussels office on June 6th, 2019. Software quality is a recurring theme in many matters handled by our TMT team. Whether our assistance relates to preparing tender documents, contracting effectively, assessing proper performance or allocating ownership and accountability in challenging IT projects, questions concerning software quality always arise.

Read more

05.06.2019 BE law
Part two - GDPR and Public Law: Data protection in public procurement

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss some GDPR-related aspects of public procurement.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring