The Court of Justice of the European Union (“CJEU”) recently declared that dynamic IP addresses should be deemed to be personal data if the user’s Internet Service Provider has additional data which allows the identification of the user. The European Union decision will help during interpretation of Turkey’s Data Protection Directive, answering the questions regarding how to define personal data.

The dispute at hand arose before German courts in 2008, where a German citizen sought to prevent websites operated by the Federal German Institutions from collecting and using his IP addresses. The claim was rejected at the first instance court level. The claimant escalated the file to the German Court of Appeals, which partially accepted the claim. Both parties appealed the matter further to the German Federal Court of Justice.

The Federal Court of Justice referred two questions to the CJEU:

  • Whether Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media service provider when a person accesses a website that provider makes accessible to the public constitutes personal data, when only the internet service provider has the additional information necessary to identify the website user, and
  • Whether Article 7(f) of Directive 95/46 must be interpreted as precluding the legislation of a Member State under which an online media services provider may collect and use a user’s personal data without his consent only to the extent necessary in order to facilitate, and charge for, the specific use of those services cannot justify use of data beyond the end of the particular use of them.

The CJEU issued a non-binding advisory decision replying positively to both questions.

It noted that if the web site operator has additional information which will enable the third parties to identify the visitor, then the visitor’s dynamic IP address constitutes personal data.

It also noted that Article 7(f) of the Directive should be interpreted as precluding the legislation of a Member State (Germany) under which an online media service provider (German Federal Institution) may have a legitimate interest to ensure the continued functioning of their websites.

(Case reference: Breyer v Bundersrepublik Deutschland, 19.10.2016, CJEU Case C-582/14)