November 10, 2016
The Court of Justice of the European Union (CJEU) considered two important questions in a case referred by the German Federal Court of Justice.
The first question concerned the problem of whether a dynamic IP address may be considered as personal data if it does not enable the person collecting the data to identify a website visitor without obtaining additional information from a third party. An IP address (Internet Protocol Address) is an identification number attached to all devices connected to the internet and enables internet service providers (ISP) and website operators to identify said device and its owner. There are two types of IP addresses, static addresses and dynamic addresses. Static IP addresses do not change. Dynamic IP addresses change each time the device is connected to the internet. The question of whether or not an IP address constitutes personal data is important as the person collecting and/or using personal data must comply with data privacy and protection legislation. In the case referred, the dynamic IP address did not enable the website operator (in this case, a German Federal Institution) to identify the visitor to the website without obtaining additional information from his ISP. The Court ruled however that the IP address constituted personal data if the website operator had the legal means to acquire the additional information necessary to identify the visitor to the website.
The second question concerned the problem of storage and use of a website visitor’s personal data without his consent. EU legislation provides for the storage and use of personal data by website operators when necessary to achieve a legitimate objective (in this case, security interests). The Court ruled that when deciding whether or not the storage and use of the data is legitimate, a balance must be found between the legitimate interests of the collector and the rights and freedoms of the visitor.
The ruling means that personal data may be stored for longer than is necessary to provide the service to the website visitor if the website operator can prove a legitimate interest in doing so.