Top EU Court: IP addresses are personal data


The EU's Court of Justice (ECJ) today looked into whether website operators such as Google or Facebook may record which information Internet users read, post or searched on the web - or whether citizens have a right to use the Internet anonymously. The ruling concerns the case of German pirate party politician and privacy activist Patrick Breyer who is suing the German government over logging all visits to government websites (Case C-582/14).

According to the court, users' IP addresses are personal data and may be collected only where allowed by data protection law.

The Court did not decide on whether website operators may retain IP addresses in bulk or whether the users privacy rights prevail. EU law does not give specific guidance on the matter.

Breyer calls on the Commission to act on the lack of specific EU rules protecting on-line privacy: "The Commission should amend EU legislation to specifically prohibit any blanket recording of our Internet use by website operators. Europe should reject the ruthless NSA method of ýcollecting it allý and enforce our right to freedom of information and expression in the digital age."

See: Judgment full-text (pdf)

See also: Your dynamic IP address is now protected personal data under EU law - CJEU rules that personal IPs can't be stored, unless to thwart cybernetic attacks or similar (arstechnica, link):

"Europe's top court has ruled that dynamic IP addresses can constitute "personal data," just like static IP addresses, affording them some protection under EU law against being collected and stored by websites.

But the Court of Justice of the European Union (CJEU) also said in its judgment on Wednesday that one legitimate reason for a site operator to store them is "to protect itself against cyberattacks."

 

Spotted an error? If you've spotted a problem with this page, just click once to let us know.

Report error