Fwd: Top German Court on Internet tracking: IP addresses are personal data

[Cecilia Tanaka]

---------- Forwarded message ----------

From:  <pab at daten-speicherung.de>


Press release:

+++ Top German Court on Internet tracking: IP addresses are personal
data +++

This week the German Federal Supreme Court (Bundesgerichtshof) looked
into whether website operators such as Google or Facebook may record
which information Internet users read, post or searched on the web – or
whether citizens have a right to use the Internet anonymously. The
ruling concerns the case of German pirate party politician and privacy
activist Patrick Breyer who is suing the German government over logging
all visits to government websites (Case VI ZR 135/13).

According to the court’s ruling, users‘ IP addresses qualify as personal
data and may be collected only where allowed by data protection law.

Contrary to some reports, the Court did not decide[2] on whether website
operators may retain IP addresses in bulk to guard against online
attacks. Instead the court referred the case back to the Court of Appeal
(Landgericht) of Berlin in order to establish a sufficient factual basis
concerning the necessity and proportionality of such metadata retention.
The court’s press release[3] translates as follows:

„In the present case the Court of Appeal’s findings were insufficient to
balance the interests at stake. The Court of Appeal did not sufficiently
establish whether retaining the applicant’s IP addresses is necessary in
order to ensure the (general) operability of the services used. The
defendent concedes that it does not retain IP addresses regarding many
of its websites due to the low risk of an attack. There are no findings
as to the risk of attack suffered by other federal websites the
applicant wishes to use. After establishing these facts the Court of
Appeal will need to balance, as required by the European Court of
Justice, the defendent’s interest in ensuring the operability of its
online media services against the applicant’s interest or fundamental
rights and freedoms. In this context due regard shall be given to the
issues of general prevention and law enforcement.“

Breyer calls on the Commission to act on the lack of specific EU rules
protecting on-line privacy: „The Commission should amend EU legislation
to specifically prohibit any blanket recording of our Internet use by
website operators. Europe should reject the ruthless NSA method of
‚collecting it all‘ and enforce our right to freedom of information and
expression in the digital age.“

Breyer argues that websites can be safe without tracking every user
across every page: „This Internet stalking is about as useful as
mounting a CCTV camera next to an open warehouse door. We need secure IT
systems, not a general suspicion against Europe’s 400 million Internet
users“.

Website operators often record and track their users online behaviour
for commercial purposes, but also to disclose records to law enforcement
agencies and owners of copyright-protected content upon request. Breyer
is challenging this practise and demands that operators anonymize users‘
IP addresses:

„Banning governments and Internet giants from identifiably recording our
browsing habits is the only way to effectively shield our private life
and interests, to prevent erroneous infringement notices and false
suspicions. IP addresses have turned out to be extremely prone to error
und unreliable when used to identify users. For as long as browsing the
Internet can result in prosecution, there is no real freedom of
information and expression on-line.

Nobody has a right to record everything we do and say on-line.
Generation Internet has a right to access information on-line just as
unmonitored and without inhibition as our parents read the paper,
listened to the radio or browsed books.“

Court’s press release (German)[4]

Report by Technology Law Dispatch (English)[5]

[2]
https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-supreme-court-confirms-dynamic-ip-addresses-may-constitute-personal-data/

[3]
http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2017&Sort=3&nr=78289

[4]
http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2017&Sort=3&nr=78289

[5]
https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-supreme-court-confirms-dynamic-ip-addresses-may-constitute-personal-data/