ECJ Confirms Dynamic IP Address May Constitute Personal Data But Can Be Logged To Combat Cyberattacks

On 19 October 2016, the European Court of Justice (ECJ) held (Case C-582/14 - Breyer v Federal Republic of Germany) that dynamic IP addresses may constitute personal data. The ECJ also held that a website operator may collect and process IP addresses for the purpose of protecting itself against cyberattacks, because in the view of the Court, preventing cyberattacks may be a legitimate interest of a website operator in its effort to continue the operability of its website.

The ECJ's ruling was based on two questions referred to it by the German Federal Court of Justice (BGH). In the underlying German proceedings, a member of the German Pirate Party challenged the German Federal Government's logging and subsequent use of his dynamic Internet Protocol (IP) address when visiting their websites. While the government is a public authority, the case was argued on the basis of German provisions that address both public and private website operators, and is therefore directly relevant for commercial companies.

IP Addresses as Personal Data

The BGH's first question to the ECJ was whether an IP address is considered personal data (i.e., any information relating to an identified or identifiable natural person) under the EU Data Protection Directive (Directive 95/46/EC). In answering the BGH's first question, the ECJ confirmed that dynamic IP addresses are considered personal data within the meaning of the Directive in circumstances where the data collector (e.g., a website operator) is likely or reasonably able to obtain information from a third party that would allow it to identify the user. In this case, the Court observed that the German website operator could report potential cyberattacks to the police or public prosecution, who would use the IP address to obtain the identity of the attacker from the third party internet service provider, and then make it available to victims (i.e., the German website operator) who request to inspect the records.

Preventing Cyberattacks is a Legitimate Interest

The BGH's second question was whether the German Telemedia Act, which permits the collection of usage data that identifies individuals exclusively for the purpose of rendering a service and billing, conflicts with the Directive's rules regarding the collection and processing of personal data. The ECJ held that the German law was too restrictive and should also allow for lawful processing of personal data if necessary to achieve a "legitimate interest" of the...