On May 16, 2017, the Federal Court of Justice ruled that dynamic IP addresses are personal data and that, under certain circumstances, they may be stored by website operators beyond temporary page retrieval (May 16, 2017, VI ZR 135/13). As a matter of principle, IP addresses are thus generally subject to data protection provisions.
The personal reference of dynamic IP addresses in the website operator’s possession may be debatable because, from the website operator’s point of view, it is initially only a number that does not allow the operator to draw conclusions with respect to the user. In addition, for internet connections by end users, this number is reassigned each time users are accessing the Internet or as a rule at least once daily. The allocation to a person is thus not possible on a permanent basis. The following question therefore arises: When can the user behind the IP address be identified?
Some time ago, the Federal Court of Justice referred this question to the Court of Justice of the European Union (CJEU).
The CJEU chose a middle path: accordingly, dynamic IP addresses may be personal data for the website operator if the operator has “legal means” which enable it to identify the data subject (19 October 2016, C-582/14).
On the basis of this preliminary CJEU ruling, the Federal Court of Justice now held that IP addresses can be stored if necessary to ensure general operability of the services. For the balancing of interests addressed by the CJEU, it is in particular necessary to ascertain the potential danger of a specific online service. In this respect, the aspects of general prevention and prosecution should also be duly taken into account.
The Federal Court of Justice decision provides courts with a lot of scope for a precise individual case decision. Since, in the case to be decided, the necessary facts were not sufficiently investigated by the appeals court, the Federal Court of Justice was unable to perform a final balancing of interests.
Tip for practice:
Website operators are advised to store IP addresses only to the extent actually required for the operability of the service. In addition, the appeals court decision should be awaited, which should lead to the criteria for storing IP addresses being specified in further detail.