Germany - CJEU hears arguments on IP addresses as personal data
Published 19 April 2016
In 2008, a German citizen challenged the German federal government's storage of IP addresses of users of government websites (the "Claim"). Whilst the Claim was initially rejected by the court of first instance, it was granted by the court of second instance in respect of its reference to the storage of IP addresses after users were no longer on government websites. Subsequently, the Claim was appealed to the German Federal Court of Justice – Bundesgerichtshof (the "German FCJ").
In connection with the above, the German FCJ referred the following questions to the Court of Justice of the European Union (the "CJEU") for a preliminary ruling (together the "Questions"):
1. Whether IP addresses constitute personal data and whether such data could therefore not be stored beyond what was considered necessary in providing an Internet service; and
2. Whether or not the EU Data Protection Directive 95/46/EC is contrary to a provision in the German Telemedia Act whereby a website provider may collect and process the personal data of users without their consent only to the extent that it is necessary to (i) enable the general functionality of the website; and (ii) arrange payment.
On 25 February 2016, the CJEU heard arguments on the Questions. It is thought that the CJEU may follow its decision in Case C-70/10 2011 (the "2011 Decision") and confirm that IP addresses are personal data.
This case is likely to reinforce the CJEU's previous position that IP addresses are personal data. Therefore, if organisations process IP addresses, they should ensure that such processing is subject to the necessary protections when processing personal data.
To read the Questions, please click here.
To read the full text of the 2011 Decision, please click here.
Submitted by Charlotte Halford, Solicitor and Shehana Cameron-Perera, Trainee Solicitor