Advocate General on IP addresses and the complete harmonization

Advocate General at the ECJ pleads for broad concept of personal reference and for the complete harmonization of the elements of consent under Directive 95/46/EC.

Since the end of 2014, an ECJ decision has been eagerly awaited on a question, submitted by the BGH (German Federal Supreme Court), as to whether a dynamic IP address always constitutes personal data from the perspective of a website operator. The Federal Supreme Court also submitted the question to the ECJ of whether the storage of an IP address by a website operator can be justified, if the address is then to be classified as personal. The final petitions of the Advocate General in this matter were published on May 12, 2016. While this does not yet mean that the ECJ will follow the argumentation of the Advocate General one-to-one, this is however frequently the case in practice. Given the explosive potential of the expected ECJ decision, it is worthwhile taking a look now at the arguments of the Advocate General.

IP addresses constitute personal data for website operators

The Advocate General is of the opinion that it is sufficient for the personal reference of an IP address if a third party exists (the Internet access provider) to whom a responsible body can "reasonably" turn in order to obtain additional information for identification purposes. The Advocate General recognizes that the corresponding information will not be obtained from an Internet access provider without further justification. Without naming specific individual cases, the Advocate General does however generally assume that there are lawful ways of requesting additional person-relatable data from an Internet provider concerning an IP address.

Change of direction towards the objective theory

Finally, the question submitted is also very important regarding the scope of the concept of person-relatability. In Germany, a narrow interpretation - according to which the only decisive matter is the knowledge and the research possibilities of the respective responsible body (so-called relative theory) - is opposed by a so-called objective theory - under which it is sufficient if it is possible for any third party to establish the personal reference. Thus far, the relative theory has had the most proponents in Germany, and has also been supported by the overwhelming majority of courts. The argumentation of the Advocate General can however be interpreted as a clear change of direction towards the objective theory. Because, for the Advocate General, even the mere existence of the possibility of obtaining information in individual cases is sufficient to fundamentally affirm that each IP address captured is person-relatable from the perspective of a website provider. Just how far this goes becomes clear if one considers that there is no standardized claim to information against an Internet provider outside of Section 109 UrhG (Copyright Act) (which is hardly likely to be relevant for the mere operation of a website). Under Section 95 et seq. TKG (Telecommunications Act), Internet providers are even forbidden from forwarding their customers' data to a website operator or other third parties.

The justified interest must be "read into" Section 15 TMG (Teleservices Act)

The Advocate General answers the second question submitted to the effect that, within the scope of the "justified interest" as defined in Art. 7 lit. f. of Directive 95/46/EC, it is justifiable for website operators to store IP addresses. The storing of data via the "blanket-clause type" justified interest is not envisaged in the corresponding data protection regulations of the TMG. Given the "full harmonization" intended by the European Data Protection Directive, the Advocate General is of the opinion that this must however also be read into the elements of consent under the TMG.

Probable seven-day storage period

The Advocate General does not provide more precise information concerning the balancing decision to be taken here. Rather, it is a matter for the national court - i.e. the Federal Supreme Court - to carry out the balancing for the specific individual case. In the specific case at hand, the Federal Supreme Court will probably orient itself towards the seven-day storage period for IP addresses that has also been conceded for Internet access providers under case law.

No exclusion of the justified interest by national Standards

The "full harmonization" of the element of consent justified interest under Art. 7 lit. f of Directive 95/46/EC could have far-reaching effects in practice. Because this would mean that the national lawmaker is no longer allowed to create (and was allowed to create) any data-protection-law element of consent that excludes recourse to the approval of a justified interest in special individual cases. For example, special elements of consent currently exist for advertising, scoring or video surveillance that exclude recourse to the justified interest, or place additional requirements on a justified interest. There have thus far also been intense discussions in the field of employee data-protection law concerning the extent to which recourse to a justified interest is possible. A list of examples could be continued at will.

Summary

If the ECJ follows the line of the Advocate General, IP addresses will always have to be treated as personal data in future, including for example in the context of Smart Home, the Internet of Things, Smart Meter, Industry 4.0 etc. In addition, the argumentation of the Advocate General shows a clear change of direction towards the objective theory of personal reference.

The following is a further important memorandum item for practice. If the existing system of elements of consent is currently reaching the limits of what is permitted under data protection law, it is worthwhile checking whether specific data processing could not be legitimized via a justified interest after all - even if special elements, actually considered conclusive, do not provide for this.

We shall also inform you of the upcoming ECJ judgment in our Newsletter as soon as the judgment has been published.