German Federal Supreme Court confirms: Dynamic IP addresses may constitute personal data

RS
Reed Smith (Worldwide)

Contributor

Reed Smith (Worldwide) logo
Reed Smith is a dynamic international law firm helping clients move their businesses forward. By delivering smart, creative legal services, we enrich clients' experiences with us and support achievement of their business goals. Our longstanding relationships and collaborative structure enable the speedy resolution of complex disputes, transactions, and regulatory matters.
According to a press release dated 16 May 2017, and following the Court of Justice of the European Union's (CJEU) preliminary ruling in Case C-582/14 dated 19 October 2016 ...
Germany Privacy

According to a press release dated 16 May 2017, and following the Court of Justice of the European Union's (CJEU) preliminary ruling in Case C-582/14 dated 19 October 2016 (see our previous blog), the German Federal Supreme Court (Bundesgerichtshof – FSC) confirmed in a judgment of 15 May 2017, case no. VI ZR 135/13 that dynamic IP addresses constitute personal data within the meaning of Article 2(a) Directive 95/46/EC, in relation to a service provider, where the service provider has the legal means which enable it to identify the data subject with additional data which the service provider has about that person.

Accordingly, the FSC held that Section 12(1) and Section 12(2) of the German Telemedia Act (Telemediengesetz – TMG) and Section 3(1) of the German Data Protection Act (Bundesdatenschutzgestz – BDSG) need to be interpreted in line with Directive 95/46/EC.

Since the IP address qualifies as personal data, it may only be stored if the requirements of Section 15(1) TMG, which sets out the requirements for storage of usage data, are fulfilled. This provision needs to be interpreted in line with Article 7(f) Directive 95/46/EC; according to the preliminary judgment of the CJEU an online media services provider may collect and use personal data relating to users of those services without his consent only in so far as that the collection and use of the data are necessary to facilitate and charge for the specific use of those services by that user, even though the objective aiming to ensure the general operability of those services may justify the use of those data after a consultation period of those websites.

The FSC stressed that this will require a balancing test which sufficiently takes into account the fundamental rights of the relevant users. The FSC emphasized that the Court of Appeal Berlin has not established a sufficient factual basis which would enable the FSC to carry out this balancing test on its own. Consequently, the FSC referred the case back to the Court of Appeal Berlin.

The full judgment has not yet been published by the FSC.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More