Is a public IP address classified as "personal data" for a third party under EU law?

Question

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in the logs of the web server.

Question: are such public IP addresses classified as "personal data" under EU law?

Notes:

• the web site owner has no possibility, by themselves, to link the public IP with an individual
• the IP address can be linked to an individual by the ISP. This ISP is unrelated to the web site owner
• there are numerous discussions about the fact that "an IP address is personal data". When digging into the documents, it becomes less clear because one of the conditions for the IP to be PII is, for the one who handles that IP, to have the "legal means" of obtaining access to the information held by the ISP in order to identify the individual. (see here or here)

Answer 1

Apparently, Yes

In the ECJ's Breyer decision the final conclusion reads:

Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

It is true that in this case the decision was actually under Directive 95/46/EC, not the GDPR, but the GDPR took its definition of personal Data directly from Directive 95/46/EC, so that should make no difference.

It is also true that in this case the website in question was operated by the German Federal government, an not by a private individual, or by a private business. A government might have "legal means" to link an IP address with an individual that a private actor does not. However in point 23 of the decision, the Court refered to the IP addresses as:

... stored by the Federal Republic of Germany, acting in its capacity as an online media services provider, ...

which seems to indicate that the same ruels were being applied to it as would have been to a private entity.

Point 44 of the decision says that:

The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46.

In point 47, the court says that:

... in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.

This leads the court to point 49, where it says that;

Having regard to all the foregoing considerations, ... Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

Nothing in the decision indicates that any particular governmental authority was considered to provide the "legal means" to get an ISP to link an IP used at a particular time to an individual.

In this page from Intersoft consulting it is said that:

Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible. ... The same also applies to IP addresses. If the controller has the legal option to oblige the provider to hand over additional information which enable him to identify the user behind the IP address, this is also personal data.

In this page from eugdprcompliant.com it is said that:

A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant.

Finally the european Commission says, on this official page:

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

...

Examples of personal data

...

an Internet Protocol (IP) address;

While the case law is scanty on the point, it appears that the consensus is that IP addresses, even dynamic IP addresses, will be considered to be Personal Data under the GDPR.

>

Answer 2

Personal Data is any Data that either on its own or when cross-referenced with other Data enabled the univocal identification of a Natural Person.

So, in the same way, your Car license plate if Personal Data when someone who has access to a repository that identifies you as the owner; anyone's IP Address is Personal Data when cross-referenced with other Data that makes possible to identify those individuals.

It is a matter of "context" in these cases (not in all cases, but in these cases).

Therefore the answer is ... it depends...

Answer 3

No.

In ECJ’s Breyer decision the "website" was run by the German Government. It was therefore deemed to have "the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person" because it could legally order the ISP to reveal who is behind a particular IP address.

The same logic does not (well, should not) apply to an individual website owner. Such owners do not have the same powers as governments. Although it would not be totally impossible for them to obtain a court order for the ISP to reveal identities behind IP addresses, this would be beyond the "means reasonably likely to be used" (Recital 26) because it would be costly and time consuming:

To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification

But bear in mind that there seems to be no legal precedent to set this answer in stone. People often prefer to "stay on the side of caution" and construe ECJ’s Breyer decision much wider than it is literally applicable i.e. to apply it to all website owners not just those run by governments. You need the balls to stand on this answer and be ready to defend it in court if ever challenged.