On February 3, 2010, Christopher Kuner, a partner in Hunton & Williams’ Brussels office and head of the firm’s EU Privacy Practice, presented to the “Stakeholders’ Dialogue on Illegal Uploading and Downloading,” organized by DG Internal Market and Services of the European Commission. Mr. Kuner presented a study which the Hunton & Williams Brussels team prepared for the Commission on the interaction of data protection law and copyright enforcement. The study covers both the legal framework under EU law and the situation in six selected EU Member States (Austria, Belgium, France, Germany, Spain and Sweden). The relationship between data protection and copyright enforcement was a point of contention in the recent amendment of the EU Directive on Privacy and Electronic Communications.

The following are the major findings of the study:

At the European level:

At the Member State level:

  • IP addresses are generally considered by DPAs and courts to be personal data, although courts in some countries (e.g., France) have taken conflicting positions on this issue.
  • IP addresses are generally considered to be traffic data, which means that they may only be processed in a limited number of circumstances and for specific purposes (such as billing and invoicing), and that consent is generally required to process them for other purposes (such as online copyright enforcement).
  • IP addresses processed in the context of online copyright enforcement may be considered to be sensitive data (judicial data), except in Spain.
  • ISPs cannot store IP addresses for the specific purpose of online copyright enforcement (except in France, where retention for the purpose of making information available to certain governmental authorities is allowed).
  • The processing of IP addresses by ISPs to pass on infringement warning notices is generally prohibited or subject to strict restrictions.
  • The general monitoring of P2P networks by right holders resulting in the creation of a database of potential copyright infringers is usually prohibited.
  • The disclosure of P2P users’ identities by ISPs to judicial authorities in the context of criminal proceedings is generally authorized.
  • The disclosure of P2P users’ identities by ISPs to right holders for civil enforcement is generally restricted by data protection law. In particular, ISPs generally may not disclose P2P users’ identities to right holders outside the context of judicial (administrative) proceedings.
  • In most Member States, it seems that little consideration was given to the interaction between data protection rules and implementation of the IP Enforcement Directive.

As the study demonstrates, the relationship between data protection law and online copyright enforcement is far from being settled. This issue will certainly be discussed in the coming months during the ongoing debate on the review of the General Data Protection Directive at the European level, and in the context of the debate around possible graduated response mechanisms at the national level.