IP address as privacy-data in European Union (EU) for specific social identities

Question

In the European Union (EU) there is a clash between direct and indirect personal data.

1. Internet Service Providers (ISP) can use the IP address to identify personal data.
2. The provider of the webservice cannot use the IP address to identify personal data.

This does mean the provider of the webservice can identify the personal data only indirectly via the ISP.

So in Germany, there usually is the term in General Terms & Conditions:

"Eine Nutzung der Internetseiten der (...) ist grundsätzlich ohne jede Angabe personenbezogener Daten möglich."

(Translation: The usage of the internet sites of (...) is basically possible without any expose of person-bound information.)

Following a text of the EU there is a line:

"(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;"

Says that IP addresses for

1. Physical
2. Physiological
3. Mental
4. Economic
5. Cultural
6. Social

identities are personal data, no matter if directly or indirectly.

Question

Assuming we have a website in a social identity, so an IP address is a personal data. Can we still say:

The usage of the internetsites of (...) is basically possible without any expose of person-bound informations.

?

Answer 1

Your example "Eine Nutzung der Internetseiten der (...) ist grundsätzlich ohne jede Angabe personenbezogener Daten möglich." doesn't have the same meaning as the English version you provided. The German example says, "You can use the website without providing personal data."

In the European GDPR, the term "data processing" basically includes everything you can do with data (see Article 4 "Definitions"), and the Recital 30 "Online Identifiers for Profiling and Identification" of the GDPR explicitly lists IP addresses as a possibility to identify users. Besides, IP addresses are widely considered as personal data. So, you could hardly say that somebody could use a website without providing personal data as the web server has to process the IP address. If the user doesn't have to provide any additional personal data, then you could argue that processing of personal data is limited to the IP address.