January 21, 2022

Volume XII, Number 21


January 20, 2022

Subscribe to Latest Legal News and Analysis

January 19, 2022

Subscribe to Latest Legal News and Analysis

January 18, 2022

Subscribe to Latest Legal News and Analysis

Court of Justice of European Union Confirms Dynamic IP Addresses To Be Personal Data

On Wednesday October 19, 2016 the Court of Justice of European Union (“CJEU”) issued its judgment in Case C-582/14, Patrick Breyer v Germany

The CJEU held that a “dynamic” IP address constitutes personal data (agreeing with the Opinion of the Advocate General from May this year).  Dynamic IP addresses qualify as personal data, even if the website operator in question cannot identify the user behind the IP address, since the users’ internet service or access providers (“ISPs”) have data that, in combination with the IP address, can identify the users in question.

The CJEU concluded that domestic law — in this case, German law — could not adopt a more restrictive interpretation of the “legitimate interests” legal basis for processing than is set out under the EU Data Protection Directive.  In that vein, the continued processing of personal data, without the user’s consent, may be justified as falling within a legitimate interest — e.g., ensuring the continued security or functioning of those websites including to protect against cyberattacks.


The CJEU was asked, through a preliminary ruling reference from the German Supreme Court, to answer two questions regarding the interpretation of certain provisions of the Data Protection Directive.  These referred questions essentially asked whether:

  • dynamic IP addresses qualify as personal data; and

  • such data may be processed by a website operator in order to ensure the security and functioning of the website.

(For the exact wording of the two questions that have been referred to the Court for a so-called preliminary ruling, see here.)

These questions arose in court proceedings in Germany that had been initiated by Mr Breyer, a German Pirate Party politician, against the German Federal Government.  Mr Breyer was, in essence, seeking to prevent German Federal institutions that operated web sites from storing his IP address for longer than the period in which he accessed and used those sites.  The Federal institutions that operated the sites could not identify users solely from the IP addresses and information that they held; in order to identify users, they would need to combine data that they held with data retained by ISPs.

CJEU decision

(1) Dynamic IP addresses as personal data

“Personal data” is defined in Article 2(a) of the Data Protection Directive as any information relating to an identified or identifiable natural person (a “data subject”).   A data subject is one who can be identified, directly or indirectly.  In light of the word “indirectly”, the CJEU relied on Recital 26 of the Data Protection Directive, which states that “to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person.” (Emphasis added.)  In other words, “it is not required that all the information enabling the identification of the data subject must be in the hands of one person” (para. 43, Judgment).  In this context, the CJEU held that additional data held by an internet access provider would “likely reasonably” by someone used to identify the data subject.

(2) Processing personal data in order to ensure the security and functioning of the website

The real issue for the CJEU in considering this second question was whether German domestic law could provide for a more narrow set of circumstances permitting the continued processing of personal data without consent than that envisaged under the Data Protection Directive.  Specifically, section 15 of the German Telemedia Act (“TMG”) allows the collection and use of telemedia users’ usage data in limited circumstances, but not for the purpose of ensuring the general operability (i.e., the security and functioning) of the telemedia service.

Past CJEU case law is clear that Member States are precluded from prescribing the outcome of the balancing of competing interests and rights under Article 7(f) of the Data Protection Directive (Joined Cases C‑468/10 and C‑469/10 ASNEF and FECEMD).  Article 7(f) of the Data Protection Directive allows data processing if “necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject.  Accordingly, the CJEU held that Article 7(f) of the Data Protection Directive precluded the application of section 15 of the TMG which applied too strict and narrow an interpretation of “legitimate interests”.  The result, although not made explicit by the CJEU, is that website operators may have a legitimate interest in ensuring the continued security or functioning of their websites (e.g., to prevent cyberattacks).

Commentary and Next Steps

The decision is significant in a number of respects.

  • Dynamic IP addresses are now considered personal data — an issue that has been uncertain for some time.

  • More generally, the CJEU’s reasoning in response to the first question follows the line of thinking that data may be personal data, provided someone, somewhere, can associate it with the individual.  This need not be the entity actually possessing the data.  This reasoning is not necessarily currently shared across all Member States and so the decision may cause Member States to consider their own interpretations and applications of the term “personal data” prior to the GDPR becoming applicable in May 2018.

  • The decision seems likely to have an impact on how certain legislators and enforcement authorities view de-identified and key-coded data, perhaps applying stricter standards.

  • It is helpful for organizations processing data that the CJEU’s scoping of “legitimate interests” continues to be broad and implicitly acknowledges that organizations may rely on “legitimate interests” to process dynamic IP addresses.

  • The CJEU did not explicitly rule on what is or is not a “legitimate interest”.  Provisions in the Data Protection Directive and GDPR, guidance from data protection authorities, and other case law will help determine this.

The case will now be sent back to the German Federal Court of Justice, which will deliver a judgment applying the CJEU’s ruling.

© 2022 Covington & Burling LLPNational Law Review, Volume VI, Number 295

About this Author

Daniel Cooper, Data privacy lawyer, Covington Burling

Daniel Cooper advises clients on information technology regulatory issues, particularly data protection, e-commerce and data security matters.

According to the latest edition of Chambers UK (2018), his "level of expertise is second to none, but it's also equally paired with a keen understanding of our business and direction." In 2017, it was noted that "he is very good at calibrating and helping to gauge risk."

Mark Young, Data privacy and cybersecurity lawyer, Covington

Mark Young advises clients on data protection, cybersecurity and intellectual property matters. He has particular expertise in regulatory compliance and legislative advocacy, cyber and data security incident preparation and management, and online IP enforcement.

According to the latest edition of Chambers UK (2018), he has "a really sharp analytical mind and good understanding of key regulations." In previous editions, he has been recognized as "a trusted adviser - practical, results-oriented and an expert in the field," and "enjoying a growing reputation...

Joseph Jones, Covington, Copyright and trademark attorney

Joe Jones is an associate in the technology and media practice group, having joined the firm as a trainee solicitor in 2014.

Mr. Jones advises emerging and leading companies on data protection and intellectual property issues, including cybersecurity, copyright, trademarks, and e-commerce. He has experience advising companies in the technology, pharmaceutical, and media sectors. His practice encompasses regulatory compliance and advisory work. He regularly provides strategic advice to global companies on complying with data protection laws in Europe and the UK....

44 20 7067 2193