---------- Forwarded message ---------- From: Press release: +++ Top German Court on Internet tracking: IP addresses are personal data +++ This week the German Federal Supreme Court (Bundesgerichtshof) looked into whether website operators such as Google or Facebook may record which information Internet users read, post or searched on the web – or whether citizens have a right to use the Internet anonymously. The ruling concerns the case of German pirate party politician and privacy activist Patrick Breyer who is suing the German government over logging all visits to government websites (Case VI ZR 135/13). According to the court’s ruling, users‘ IP addresses qualify as personal data and may be collected only where allowed by data protection law. Contrary to some reports, the Court did not decide[2] on whether website operators may retain IP addresses in bulk to guard against online attacks. Instead the court referred the case back to the Court of Appeal (Landgericht) of Berlin in order to establish a sufficient factual basis concerning the necessity and proportionality of such metadata retention. The court’s press release[3] translates as follows: „In the present case the Court of Appeal’s findings were insufficient to balance the interests at stake. The Court of Appeal did not sufficiently establish whether retaining the applicant’s IP addresses is necessary in order to ensure the (general) operability of the services used. The defendent concedes that it does not retain IP addresses regarding many of its websites due to the low risk of an attack. There are no findings as to the risk of attack suffered by other federal websites the applicant wishes to use. After establishing these facts the Court of Appeal will need to balance, as required by the European Court of Justice, the defendent’s interest in ensuring the operability of its online media services against the applicant’s interest or fundamental rights and freedoms. In this context due regard shall be given to the issues of general prevention and law enforcement.“ Breyer calls on the Commission to act on the lack of specific EU rules protecting on-line privacy: „The Commission should amend EU legislation to specifically prohibit any blanket recording of our Internet use by website operators. Europe should reject the ruthless NSA method of ‚collecting it all‘ and enforce our right to freedom of information and expression in the digital age.“ Breyer argues that websites can be safe without tracking every user across every page: „This Internet stalking is about as useful as mounting a CCTV camera next to an open warehouse door. We need secure IT systems, not a general suspicion against Europe’s 400 million Internet users“. Website operators often record and track their users online behaviour for commercial purposes, but also to disclose records to law enforcement agencies and owners of copyright-protected content upon request. Breyer is challenging this practise and demands that operators anonymize users‘ IP addresses: „Banning governments and Internet giants from identifiably recording our browsing habits is the only way to effectively shield our private life and interests, to prevent erroneous infringement notices and false suspicions. IP addresses have turned out to be extremely prone to error und unreliable when used to identify users. For as long as browsing the Internet can result in prosecution, there is no real freedom of information and expression on-line. Nobody has a right to record everything we do and say on-line. Generation Internet has a right to access information on-line just as unmonitored and without inhibition as our parents read the paper, listened to the radio or browsed books.“ Court’s press release (German)[4] Report by Technology Law Dispatch (English)[5] [2] https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-s... [3] http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2017&Sort=3&nr=78289 [4] http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2017&Sort=3&nr=78289 [5] https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-s...