Dynamic IP addresses as personal data
Question about IP addresses as personal data is bit tricky.
IP address (short for Internet Protocol address) is a unique numerical label assigned to an information technology device (e.g., a computer or smartphone) participating in a network using the Internet Protocol system to identify itself and communicate with other devices. IP addresses can be static or dynamic. Static IP addresses are assigned to device permanently while dynamic IP addresses is reassigned every time every time the device is booted. Today IP addresses are mostly assigned dynamically.
In accordance with EU Data Protection Directive personal data is information relating to an identified or identifiable natural person, but IP address is allocated to specific device not person, and behind one IP address might be several devices used by different people. Even one device may be used by several people. Therefore it is very hard to identify individual user just by IP address.
Nevertheless, Working Party 29 has advised (e.g. in its opinion on search engines) that IP addresses are treated as personal data. Also Court of Justice of the European Union (CJEU) in case Scarlet v. SABAM already held that users’ IP addresses “are protected personal data because they allow those users to be precisely identified“. Though court didn’t explore the issue much deeper as case was about copyright not personal data.
Question of IP addresses as personal data is up again. On 28 October 2014 the German Federal Court (Bundesgerichtshof) referred a question to the CJEU to clarify whether a dynamic IP address stored by an website operator is personal data if additional information required to re-identify the user is held by a third party. (Read good review of this case on EU Law Radar.)
Few days ago Advocate General Manuel Campos S?nchez-Bordona issued an opinion in this case suggesting that dynamic IP addresses fall within definition of personal data as website operator?at any time could ask the Internet Service Provider (ISP) for additional data to combine it with the dynamic IP address and re-identify user.
The court is yet to give its final decision. The Advocate General’s opinion is not binding to CJEU and in its judgement court can make different conclusions. However, in majority of cases CJEU follows Advocate General’s opinion.
