European Court of Justice’s IP address decision and privacy · 2016-10-21 15:26 by Rachel Brochado
The data protection community has eagerly awaited for October 19th, the day when the European Court of Justice (“ECoJ”) finally decided that dynamic IP addresses are constituted as personal data in relation to publishers of a website. The outcome of the ruling is extremely important for all kinds of website providers as – according to European privacy laws – personal data may only be collected and used as a legislative provision permits, or the user has consented to it. Furthermore, in Germany (at least according to the prevailing opinion), legal permission to store personal data for the purpose of data security does not exist. That’s why the storage of raw IP addresses in website log files for the purpose of data security has been subject to controversial discussions.
To summarize, the ECoJ decided that a dynamic IP address stored by a website provider when a user accesses the website constitutes as personal data in relation to that provider. The provider has the legal means, which enable it to identify the data subject with additional data that the internet service provider has about that person. Such legal means can be, i.e., the right to information against the internet service provider for initiating criminal prosecution, but no illegal activities to get further information. As a consequence in Germany, where website providers do have the right to information for the purpose of initiating criminal prosecution, IP addresses always constitute personal data for all kind of German website providers – no matter if they require registration or not. But, as the ECoJ has further decided, the German legislation that does not allow the storage of raw IP addresses in website log files for the purpose of data security is not in compliance with the original wording of the EU Privacy Directive.
In a nutshell this means that IP addresses constitute personal data for website providers in Germany, but the storage of log file data including IP addresses is permitted for data security purposes.
Privacy and IP addresses at Adblock Plus
We at Adblock Plus take privacy very seriously. It’s part of our core values to collect as little data as possible and to protect data not only by legal agreements, but also technically. As a matter of fact, the only personal data we collect when you visit our websites is the IP address for data security purposes only (in compliance with the ECoJ decision). We store the IP address separately from other log file data and delete it after 30 days.
As you know, we don’t require any registration for the use of Adblock Plus. That’s why we don’t have any usage profiles of you.
Commenting is closed for this article.