3

Situation: an individual in the EU has a web site available on Internet (= if you are on Internet, you can connect to that web site). The IP addresses of the connections to this web site are stored in the logs of the web server.

Question: are such public IP addresses classified as "personal data" under EU law?

Notes:

  • the web site owner has no possibility, by themselves, to link the public IP with an individual
  • the IP address can be linked to an individual by the ISP. This ISP is unrelated to the web site owner
  • there are numerous discussions about the fact that "an IP address is personal data". When digging into the documents, it becomes less clear because one of the conditions for the IP to be PII is, for the one who handles that IP, to have the "legal means" of obtaining access to the information held by the ISP in order to identify the individual. (see here or here)
5

Apparently, Yes

In the ECJ's Breyer decision the final conclusion reads:

Article 2(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

It is true that in this case the decision was actually under Directive 95/46/EC, not the GDPR, but the GDPR took its definition of personal Data directly from Directive 95/46/EC, so that should make no difference.

It is also true that in this case the website in question was operated by the German Federal government, an not by a private individual, or by a private business. A government might have "legal means" to link an IP address with an individual that a private actor does not. However in point 23 of the decision, the Court refered to the IP addresses as:

... stored by the Federal Republic of Germany, acting in its capacity as an online media services provider, ...

which seems to indicate that the same ruels were being applied to it as would have been to a private entity.

Point 44 of the decision says that:

The fact that the additional data necessary to identify the user of a website are held not by the online media services provider, but by that user’s internet service provider does not appear to be such as to exclude that dynamic IP addresses registered by the online media services provider constitute personal data within the meaning of Article 2(a) of Directive 95/46.

In point 47, the court says that:

... in the event of cyber attacks legal channels exist so that the online media services provider is able to contact the competent authority, so that the latter can take the steps necessary to obtain that information from the internet service provider and to bring criminal proceedings.

This leads the court to point 49, where it says that;

Having regard to all the foregoing considerations, ... Article 2(a) of Directive 95/46 must be interpreted as meaning that a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.

Nothing in the decision indicates that any particular governmental authority was considered to provide the "legal means" to get an ISP to link an IP used at a particular time to an individual.

In this page from Intersoft consulting it is said that:

Since the definition includes “any information,” one must assume that the term “personal data” should be as broadly interpreted as possible. ... The same also applies to IP addresses. If the controller has the legal option to oblige the provider to hand over additional information which enable him to identify the user behind the IP address, this is also personal data.

In this page from eugdprcompliant.com it is said that:

A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant.

Finally the european Commission says, on this official page:

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

...

Examples of personal data

...

an Internet Protocol (IP) address;

While the case law is scanty on the point, it appears that the consensus is that IP addresses, even dynamic IP addresses, will be considered to be Personal Data under the GDPR.

>

  • What would then be an online media service provider without "the legal means"? If all have such means why would then the decision even mention the condition of having them? – Greendrake Jun 26 at 22:35
  • @green The decision mentioned the possibility that a national law might prohibit the ISP from providing the ionfo to another, if such a law was in effect, that would leave the site owner without any legal means. Moreover the decision seemed to be trying to reason from first principles, and show that means were available. – David Siegel Jun 27 at 2:25
  • A law prohibiting the ISP from disclosing the info is only one variant of "the legal means". The other, as mentioned in [46] of the decision, is "or practically impossible on account of the fact that it requires a disproportionate effort in terms of time, cost and man-power, so that the risk of identification appears in reality to be insignificant". I read that as if finding out is impracticable (Recital 26) it also means lack of "legal means". – Greendrake Jun 27 at 5:21
  • Thanks for the extended information. I see that there is unfortunately a lot of stress on the "dynamic" nature of IP addresses (which is completely irrelevant - a dynamic IP address is as much traceable to an individual as a static one) rather than the realistic ability to link an IP to an individual. – WoJ Jun 27 at 6:17
  • @WoJ interesting considering that various courts around the world have ruled in several cases that an IP address is not enough evidence to require an ISP to hand over account holder information in copyright infringement lawsuits... the disconnect between what some courts or jurisdictions consider enough to identify an "individual" (dozens to tens of thousands of people can share an IP address behind NAT) is astounding. – user4210 Jun 27 at 10:49
0

Personal Data is any Data that either on its own or when cross-referenced with other Data enabled the univocal identification of a Natural Person.

So, in the same way, your Car license plate if Personal Data when someone who has access to a repository that identifies you as the owner; anyone's IP Address is Personal Data when cross-referenced with other Data that makes possible to identify those individuals.

It is a matter of "context" in these cases (not in all cases, but in these cases).

Therefore the answer is ... it depends...

  • I am not sure I understand. It depends on what for the specific case I mentioned? – WoJ May 29 at 15:35
  • If you have the means or not to assess the Data Subject's identity through his/ her IP address (the ISP does... you most likely not, yet you need to document it on your assessment towards compliance if that is one Data you get). – Rui Freitas Serrano May 29 at 18:03
  • 1
    "you most likely not" if it's a plain static web site. But if it has login etc. the likelihood is that they can actually link IP to login. – cbeleites May 29 at 18:48
  • IP addresses are temporary when connecting from home or mobile devices. In Germany the Data providers are required to store the information which customer used which IP for (I believe) around 12 months. A court order is needed to retrieve this information in cases of serious crimes. The sites may store the IP, but without the customer information it is useless. The customer information is protected, the IP probely not. – Mark Johnson May 29 at 21:57
-1

No.

In ECJ’s Breyer decision the "website" was run by the German Government. It was therefore deemed to have "the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person" because it could legally order the ISP to reveal who is behind a particular IP address.

The same logic does not (well, should not) apply to an individual website owner. Such owners do not have the same powers as governments. Although it would not be totally impossible for them to obtain a court order for the ISP to reveal identities behind IP addresses, this would be beyond the "means reasonably likely to be used" (Recital 26) because it would be costly and time consuming:

To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification

But bear in mind that there seems to be no legal precedent to set this answer in stone. People often prefer to "stay on the side of caution" and construe ECJ’s Breyer decision much wider than it is literally applicable i.e. to apply it to all website owners not just those run by governments. You need the balls to stand on this answer and be ready to defend it in court if ever challenged.

  • It is true that this decision concerned a government-run website. But the decision did not cite any specific powers of the government, and repeatedly used the phrase 'the government as website operator". Nothing in the decision says or implies that it would have been different with a non-government. I am not aware of any further decision on the point for any site, government or private. The official EC website says that an IP is personal Data for all users. To assert otherwise and treat IPs as non-personal data might be risky. – David Siegel Jun 27 at 3:00
  • @DavidSiegel "The official EC website says that an IP is personal Data for all users." This fact is hard to deny indeed. But I suspect those who wrote that EC website page did it just to stay on the side of caution. By no means that page is a law. – Greendrake Jun 27 at 5:28
  • 1
    Some IP addresses are assigned to devices such as routers, switches, bridges, gateways, proxies, firewalls, repeaters, NATs, printers, webcams in public places. Those IP addresses are not personal data within the meaning of GDPR. Therefore not all IP addresses are personal data. The EC webpage is an explainer erring on the side of caution, not a legal document. The key is whether one can reasonably or practically identify an individual from the IP address alone or in combination with other pieces of data. – Lag Jun 27 at 8:33
  • @Green I am not asserting that the EC page is a law -- it is indeed an explainer, and may over simplify the actual law. and as I saw in my answer, the "IP is personal data" concept has NO case law for non-government sites. it may well be that it will not be held to be so in a case like the one in the question. But most available and all official sources currently take the position that any IP from a person's workstation must be treated as personal data, like a name. Perhaps this will be clarified. Saying private person cannot get ISP data to link IP and name is logical, but may not be law. – David Siegel Jun 27 at 11:35
  • 1
    @Lag huh? All my sites are behind load balancers and all my sites log the proper IP address of the visitor - it's trivial to set up a load balancer or reverse proxy so that the source IP doesn't change. – user4210 Jun 27 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.