In the European Union (EU) there is a clash between direct and indirect personal data.
- Internet Service Providers (ISP) can use the IP address to identify personal data.
- The provider of the webservice cannot use the IP address to identify personal data.
This does mean the provider of the webservice can identify the personal data only indirectly via the ISP.
So in Germany, there usually is the term in General Terms & Conditions:
"Eine Nutzung der Internetseiten der (...) ist grundsätzlich ohne jede Angabe personenbezogener Daten möglich."
(Translation: The usage of the internet sites of (...) is basically possible without any expose of person-bound information.)
Following a text of the EU there is a line:
"(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;"
Says that IP addresses for
identities are personal data, no matter if directly or indirectly.
Assuming we have a website in a social identity, so an IP address is a personal data. Can we still say:
The usage of the internetsites of (...) is basically possible without any expose of person-bound informations.