Pressemitteilung

C-582/14;

Rechtskräftig: unbekannt!

The operator of a website may have a legitimate interest in storing certain personal data relating to visitors to that website in order to protect itself against cyberattacks

Leitsatz des Gerichts:

The dynamic internet protocol address of a visitor constitutes personal data, with respect to the operator of the website, if that operator has the legal means allowing it to identify the visitor concerned with additional information about him which is held by the internet access provider

Click here to the full text of the judgement

Mr Patrick Breyer has brought an action before the German courts seeking an injunction to prevent websites, run by the Federal German institutions that he consults, from registering and storing his internet protocol addresses (‘IP addresses’¹). Those institutions register and store the IP addresses of visitors to those sites, together with the date and time when a site was accessed, with the aim of preventing cybernetic attacks and to make it possible to bring criminal proceedings.

The Bundesgerichtshof (Federal Court of Justice, Germany) has made a reference to the Court of Justice asking whether in that context ‘dynamic’ IP addresses also constitute personal data, in relation to the operator of the website, and thus benefit from the protection provided for such data. A dynamic IP address is an IP address which is different each time there is a new connection to the internet. Unlike static IP addresses, dynamic IP addresses do not enable a link to be established, by means of files accessible to the public, between a specific computer and the physical connection to the network used by the internet service provider. Therefore, only Mr Breyer’s internet service provider has the additional information necessary to identify him.

Furthermore, the Bundesgerichtshof asks whether the operator of a website must, at least in principle, have the possibility to collect and subsequently use visitors’ personal data in order to ensure the general operability of its website. It observes, in that regard, that most academic commentators in Germany interpret the relevant German legislation as meaning that those data must be deleted at the end of the consultation period unless they are required for billing purposes.

By today’s judgment, the Court replies, first of all, that a dynamic IP address registered by an ‘online media services provider’ (that is by the operator of a website, in the present case the German Federal institutions) when its website, which is accessible to the public, is consulted constitutes personal data² with respect to the operator if it has the legal means enabling it to identify the visitor with the help of additional information which that visitor’s internet service provider has.

The Court observes, in that regard, that in Germany there appear to be legal channels enabling the online media services provider³ to contact the competent authority, in particular, in the event of cyberattacks, so that the latter may take the steps necessary to obtain that information from the internet service provider and subsequently bring criminal proceedings.

Second, the Court states that EU law⁴ precludes the legislation of a Member State under which an online media services provider may collect and use a visitor’s personal data, without his consent, only to the extent that it is necessary to facilitate and invoice the specific use of services by that visitor, so that the objective aiming to ensure the general operability of those services cannot justify the use of such data after those services have been accessed.

The Court recalls that, according to EU law, the processing of personal data is lawful, inter alia, if it is necessary to achieve a legitimate objective pursued by the controller, or by the third party to which the data are transmitted, provided that the interest or the fundamental rights and freedoms of the data subject does not override that objective.

The German legislation, as interpreted by the majority of legal commentators, reduces the scope of that principle, by excluding the possibility of balancing the objective of ensuring the general operability of online media against the interest or the rights and freedoms of visitors.

In that context, the Court emphasises that the Federal German institutions, which provide online media services, may have a legitimate interest in ensuring the continued functioning of their websites which goes beyond each specific use of their publicly accessible websites.

--------------
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
---------------
¹IP addresses are series of digits assigned to networked computers to facilitate their communication over the internet.
When a website is consulted, the IP address of the computer seeking access is communicated to the server on which the website consulted is stored. That connection is necessary so that the data accessed maybe transferred to the correct recipient.
²2 Within the meaning of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
³As regards the present case, in which the websites concerned are run by the Federal German institutions, the Court observes that it appears that the Federal German institutions act, in spite of their status as public authorities, as individuals.
⁴Specifically Directive 95/46.

-----------------------------------------------------
Die von uns erfassten Urteile wurden oft anders formatiert als das Original. Dies bedeutet, daß Absätze eingefügt und Hervorhebungen durch fett-/kursiv-/&farbig-machen sowie Unterstreichungen vorgenommen wurden. Dies soll verdeutlichen, aber keinesfalls natürlich den Sinn verändern.Wenn Sie vorsichtshalber zusätzlich die Originalversion sehen möchten, hier ist der Link zur Quelle (kein Link? Dann ist dieser Link nicht in unserer DB gespeichert, z.B. weil das Urteil vor Frühjahr 2009 gespeichert worden ist).